Privacy-preserving Representation Learning by Disentanglement

1 INTRODUCTION . In recent years , learning with DNNs has brought impressive advances to the state-of-the-art across a wide variety of machine-learning tasks and applications . Yet , these approaches are generally only capable of significant performance leaps when large amounts of training data are provided for training purposes . However , building and curating such large data corpora comes with many strings attached . Firstly , it is cumbersome , expensive as well as time consuming to amass sufficient and foremost clean data . Apart from that , amassing large amounts of data increases the risk of privacy creep , i.e . subtly encoding privacy related information Narayanan & Shmatikov ( 2006 ) ; Backstrom et al . ( 2007 ) . In this regard , many datasets have been released into the public domain that are unintentionally permeated with private information about individuals , raising serious concerns about data privacy . In Narayanan & Shmatikov ( 2006 ) anonymization could be reversed by making use of publicly available data , e.g . movie reviews . In Wachinger et al . ( 2015 ) showed , that the surface of magnet resonance images ( MRI ) of the brain can be used to identify people potentially allow for unintended disease progression . Growing privacy concerns will entails the risk of becoming a major deterrent in the widespread adoption of machine learning and the attainment of their concomitant benefits . Therefore , reliable and accurate privacy-preserving methodologies are needed , which is why the topic lately has enjoyed increased attention in the research community . Several efforts have been made in machine learning to develop algorithms that preserve user privacy while achieving reasonable predictive power . This is even more challenging in the client-server scenario . Therein , the clients are supposed to send information to the server , which in turn then performs operations such as training for the client . The crucial aspect in this case is about the client ’ s confidential data . As an example , consider a set of clients that aim at collaboratively learning an attribute classifier on face images , while preserving the identities of the individuals . Ideally the trained model , which classifies non-sensitive attributes ( e.g. , having glasses or not ) with high accuracy , at the same time fails in classifying sensitive attributes of them ( e.g. , gender ) . A standard approach to address the privacy issue in the client-server setup is to anonymize the data of clients . This is often achieved by directly obfuscating the private part ( s ) of the data and/or adding random noise to raw data . Consequently , it is the noise level controlling the trade-off between predictive quality and user privacy ( e.g. , Differential Privacy Dwork ( 2006 ) ; Abadi et al . ( 2016 ) ) . These approaches , associate a privacy budget with all operations on the dataset . Complex training procedures run the risk of exhausting the budget before convergence . Another widely adopted solution is rely on encoded data representation . Following this notion , instead of the client ’ s data a feature representation is transferred to the server instead . Unfortunately , the extracted features may still contain rich information , which can breach user privacy Osia et al . ( 2017 ; 2018 ) . Specifically , in the example above , an attacker can exploit the eavesdropped features to reconstruct the raw image , and hence the person on the raw image can be re-identified from the reconstructed image Mahendran & Vedaldi ( 2015 ) .In addition , the extracted features can also be exploited by an attacker to infer private attributes Salem et al . ( 2019 ) . A recent solution to such a problem has been federated learning McMahan et al . ( 2016 ) ; Geyer et al . ( 2017 ) , which allows us to collaboratively train a centralized model while keeping the training data decentralized . The idea behind this strategy is that the clients transfer the training gradients of data to the server instead of the data itself . While such an approach is appealing to train a neural network with data hosted in different clients , it does not allow the use of a centralized model for making a prediction at test time . Furthermore , transferring the models between clients and server entails significant data transmission , which considerably prolongs training . What is more , averaging the gradients across the clients further slows the backpropagation . Most importantly , all of the aforementioned methods are mainly applicable when the private attributes are known a priori . That his , these approaches typically fail to prevent privacy attacks when the private information contained in the dataset is not explicitly identified . Some scenarios also defy simple annotation of private content , e.g . imagery of military and civilian commodities . In such scenarios , it is highly desirable to automatically remove content that may be subject to sensitive information . This situation is further aggravated in domains such as low-shot learning with scarcity of training examples and associated privacy labels , entailing ambiguity w.r.t . sensitive features ( i.e. , sensitive features are the ones reveal privacy ) . In this paper , we focus on the following fundamental questions : how can we learn representations of a dataset in order to minimize the amount of information which could be revealed about the identity of each client ? The main goal is to enable an analyst to learn relevant properties ( e.g . regular labels non-privacy infringing ) of a dataset as a whole , while protecting the privacy of the individual contributors ( private labels , which can identify a client ) . This assumes the database is held by a trusted server that can learn a privacy-preserving representations , i.e . by sanitizing the identityrelated information from the latent representation . Specifically , we postulate the decomposition of the latent representation into two latent factors : style and content . In this regard , style captures the private aspects of the data , whereas content encodes the public part . Thus , it is the public part that should be used for training downstream tasks as it can be transferred without compromising privacy . Following this notion , style encodes patterns that are shared among the samples of each client . In contrast to that , the content encodes information about concepts , which is shared across clients . Ultimately , this implies a disentanglement in the feature space in . private features and public features . Our proposed method is built on top of the popular Variational Autoencoders ( VAE ) Kingma & Welling ( 2013 ) , where it used as core representation learning paradigm . VAE consists of two networks , namely an encoder and a decoder . The former maps a data sample to a latent representation , while the latter maps this representation back to data space . VAE networks are trained by minimizing a cost function that encourages learning a latent representation , which leads to realistic data synthesis while simultaneously ensuring sufficient diversity in the synthesized data . This is achieved by minimizing the distance between input and reconstruction subject to distributional regularization on the latent space . In addition , to the VAE entailed cost functions , we augment the loss space with additional terms namely “ content classification loss ” and “ style confusion loss ” . In context of a supervised setup , the former is utilized to enforce for target predictability for a downstream task , while the latter encourage preserving the privacy . We show that , this two additional terms can enforce disentanglement of the private and public parts of the representation , as well utilization in context of weakly supervised scenario , where the downstream attributes are not known a priori . In summary , the main contributions of this paper are the three-fold . First , we pose the privacypreserving representation learning problem as learning disentangled representations in a client- server setup . Second , we propose to learn disentangled representations from the client-level supervision by adding two novel loss terms to VAE . Third , we demonstrate experimentally that our proposed method learns a semantically meaningful privacy-preserving disentangled representation of client data . 2 RELATED WORKS . Our method is different from Dwork et al . ( 2017 ) ; Dwork ( 2006 ) ; Ryoo et al . ( 2017 ) ; Abadi et al . ( 2016 ) , which focus on learning privacy-preserving models by perturbing raw data before sending them to the server . A key difference compared to these methods is that they share the data directly to the server , whereas our method proposes to send representation instead . The advantages of a representation sharing for client-server learning have been investigated recently in Osia et al . ( 2017 ; 2018 ) . Nevertheless , such representation is proven to contain some privacy revealing information of clients . The recent success of adversarial learning has led to the increased adoption of this technique for learning representation to preserve sensitive information in different type of data . For instance , Srivastava et al . ( 2019 ) proposed to learn privacy-preserving representations for automatic speech recognition ( ASR ) . In Yang et al . ( 2018 ) a representation is learned on the raw student clickstream event data , captured as they watch lecture videos in massive open online courses . In Li et al . ( 2019 ) , the authors proposed an obfuscator that is designed to hide privacy related sensitive information from the features using adversarial training . Similarly , Kim et al . ( 2019 ) is based on adversarial learning , which encodes images to obfuscate the patient identity while preserving enough information for a medical segmentation task . Pittaluga et al . ( 2019 ) considered a formulation based on adversarial optimization between the encoding function and estimators for the private tasks . In our work , however , a completely different perspective on representation sharing is selected . We specifically propose a representation learning method , which facilitates disentanglement of private and public features at minimal additional training cost . This leads to a more privacy-preserving representation , while maintaining the method complexity at manageable level . Most related to our paper is the work by Feutry et al . ( 2018 ) , which aims at learning representations that preserve the relevant part of the information while dismissing information about the private labels corresponding to the clients ’ identity . A key difference compared to this method is that they require labels for the downstream task during representation learning . In contrast to that , our setting allows for testing on unseen downstream tasks - see Sec . 3.2 . Very recently , Chen et al . ( 2018 ) proposed a complex method for privacy-preserving representation learning . However , to our knowledge , this is the first work proposing to disentangle private and public features using only the client level information . At last , we note that our model is different from the federated learning methodology in McMahan et al . ( 2016 ) ; Geyer et al . ( 2017 ) , which focuses on learning a decentralized private model by sharing gradient updates instead of representations . While we do not consider their framework here , our method could also be extended to those settings , leading to interesting future research directions . Other related works include Bouchacourt et al . ( 2018 ) ; Ganin & Lempitsky ( 2014 ) ; Creager et al . ( 2019 ) 3 PROPOSED METHOD . We want to learn representations that , beyond being private for a variety of sensitive attributes , can be adapted simply and compositionally for predicting many test-time task labels . We consider a twostage client-server learning , where in the first stage we learn a private representation of the data , and in the second stage , the actual downstream task is performed . Our approach to this problem involves learning a disentangled representation that allows for easy sensitization of latent representation in terms of privacy . Specifically , we isolate information about sensitive and non-sensitive attribute to separate subspaces , while ensuring that the latent space factorizes these subspaces independently . Naturally , depending on the assumptions related to the downstream task condition ( if it is known a priori or not ) , we propose multiple variants . We consider the cases where the the downstream task is known a priori ( i.e. , supervised disentanglement ) , and the case where it is not know a priori ( i.e. , weakly-supervised disentanglement ) . Ultimately , the goal is to learn a representation z ∈ Rm of data x ∈ Rk with z = f ( x ) andm < < k , which decomposes into two parts ( z ? ∈ Rm , z• ∈ Rn ) = z , where without loss of generality we assume m = n , representing the public and private information , respectively . Thereby , the public component should reveal as little as possible about sensitive information . That is we want to learn a function f that learns the representation s.t . z ? ⊥z• . Ideally , this representation has strong utility for a multitude of downstream tasks . To this end , we employ a Variational Auto-Encoder ( VAE ) Kingma & Welling ( 2013 ) in combination with regularization terms . The VAE serves the purpose that the input is compressed in a meaningful fashion . However , VAE alone does not consider learning a representation that is useful for downstream tasks or puts restrictions in terms of privacy of attributes or latent factors . Attaching additional constraints on the latent representation is non-trivial . This becomes even more challenging , if the downstream task is not known a priori Locatello et al . ( 2019 ) . The proposed approach makes use of a vanilla VAE architecture that assumes isotropic Gaussian as latent prior p ( z ) = N ( 0 , I ) . Optimization of VAE entails maximization of the Evidence Lower Bound ( ELBO ) criterion , LV AE ( p , q ) = Eq ( z|x ) [ log p ( x|z ) ] −DKL [ q ( x|z ) ‖p ( z ) ] , ( 1 ) where the first time is the reconstruction loss , and the second one the Kullback-Leibler divergence w.r.t . the prior distribution . Typically , the associated encoder q ( z|x ) and decoder q ( x|z ) functions are realized with Gaussians , whose parameters θp , θq are estimated using neural networks . In order to facilitate disentanglement of the private and public component we utilize different multiple classification tasks . To this end we define a mapping based on a deep feed-forward architecture that takes as input the latent representation z and predicts a label y ∈ Y , defined as y = g ( z , θ ) , which is parameterized by θ . Specifically , we distinguish between public and private attributes Y ? , Y• , respectively . The first objective is to predict the public and private labels based on their section of the latent representation . That is , ỹ ? = g ? ( z ? ; θ ? ) and ỹ• = g• ( z• ; θ• ) , ( 2 ) with the associated loss terms Lθ ? ( y ? , ỹ ? ) , Lθ• ( y• , ỹ• ) , which are typically realized with crossentropy . An obvious solution is to just optimize the functional comprising the VAE together the classification terms , pushing for classification based on each latent sub-vector , yielding : E ( θp , θq , θ ? , θ• ) = λV AE · LV AE + λ ? · Lθ ? + λ• · Lθ• , ( 3 ) where λ . ∈ R represents a scaling parameter . However , following this notions leads to a presentation that does not fulfill z ? ⊥z• . That is , there is information leakage between the terms , particularly when the attributes to be classified are not strictly semantically disentangled . Generally speaking , the disentangled latent code should capture no more than one semantically meaningful factors of variation in the data w.r.t . private and public attributes , respectively . This is in particular problematic , when there is excess information capacity in the bottleneck layer generating the latent representation . Thus , in order to push for disentanglement , we employ adding label confusion terms . This entails adding , additional classification terms . The underlying notion is that sensitive attributes should not be predictable from public ones . The follow-up step , depends on the boundary conditions for learning the downstream tasks . Therefore , we decompose the into two variants . The first variant , assumes that the downstream task is a priori know . This allows , for an optimal disentanglement of public and private information , such that sensitive content is not compromised . The specifics of this scenario are discussed in Sec . 3.1 . On the other hand , if the downstream task is not a priori know , the objective is to learn a representation that does not contain sensitive information in the public part , and yet is rich in terms of expressive power for a multitude of tasks . This is discussed in Sec . 3.2 .

Summary: This paper investigates the use of variational auto-encoders (VAEs) and disentanglement to create high quality data representations that hide sensitive attributes. The authors consider two settings: (1) a supervised setting where both the sensitive labels and the downstream machine learning task labels are available to the data holder, and (2) a weakly supervised setting where only sensitive attributes are available. For both settings, the authors propose creating data representations that have 2 components: component 1 captures any information in the data bout the sensitive attributes, and component 2 captures everything else (especially the information useful for a downstream machine learning task). The goal is to ensure that these two components are disentangled.  This is done by training classifiers on each component: 2 classifiers that try to reconstruct the sensitive attributes from each component separately (and in the supervised setting, 2 other classifiers that guess the downstream ML task from each component separately). The overall loss captures all components and ensures that one cannot reconstruct the sensitive attributes from component 2.