Interpretable Complex-Valued Neural Networks for Privacy Protection

1 INTRODUCTION . Deep neural networks ( DNNs ) have shown superb capabilities to process massive volume of data , and local devices such as mobile phones , medical equipment , Internet of Things ( IoT ) devices have become major data entry points in recent years . Although on-device machine learning has exhibited various advantages , it usually burdens thin devices with overwhelming computational overhead . Yet offloading data or processed features to a cloud operator would put the individual privacy at risk . For example , if a user has a virtual assistant at home , it should not worry about its private data being collected and processed by an untrusted cloud operator . The operator , on the other hand , should not be able to recover original signals or their interpretation . However , as shown in the previous literature ( Dosovitskiy & Brox ( 2016 ) ; Zeiler & Fergus ( 2014 ) ; Mahendran & Vedaldi ( 2015 ) ; Shokri et al . ( 2017 ) ; Ganju et al . ( 2018 ) ; Melis et al . ( 2019 ) ) , intermediatelayer features face many privacy threats , where the adversary either reconstructs the input or infers unintended properties about the input . Hence , on-device processing encounters a dilemma , i.e . while we expect intermediate-layer features to yield high accuracy , we certainly would not want sensitive information to be leaked . Therefore , we propose a novel method which tweaks a conventional neural network into a complexvalued one , such that intermediate-layer features are released without sacrificing input privacy too much . More precisely , we turn the original real-valued features into complex-valued ones , rotate these features by a random angle , and feed them to the cloud for further processing . We face two significant challenges in the design . First , the tweaked features have to be correctly handled by the DNN on the cloud . Although network structures vary depending on the input types , it is desired that the piecewise linearity of features to be preserved , so that the resulting accuracy does not degrade too much compared with the original features . Second , an adversary attacker who intercepts the features in the middle should not be able to recover the exact input , nor can it figure out the correct output . Most importantly , the neural network is supposed to be trained using the original data without additional human supervision , and is efficient to conduct inference . ∗Quanshi Zhang is the corresponding author with the John Hopcroft Center and MoE Key Lab of Artificial Intelligence AI Institute , Shanghai Jiao Tong University , China . zqs1022 @ sjtu.edu.cn To overcome the first challenge , we tailor operations of DNN to make the succeeding computation at the cloud invariant to feature rotations , i.e. , the DNN can correctly handle the feature and preserve the rotated angle in the output . For the second issue , we adopt generative adversarial networks ( GAN ) to generate synthesized features to hide the original ones . It guarantees k-anonymity such that , when an adversary tries to recover the original input from the complex-valued features , it would get at least k different inputs ( Please see Appendix B for detailed discussion ) . Each of the k reconstructed inputs has equivalent probabilities of being the original input for the attacker . Apart from the GAN part , the training of the neural network adds little additional computation overhead and requires no extra denotations . Contributions of this study can be summarized as follows . We propose to transform conventional DNNs into complex-valued ones , which hide input information into a randomly chosen phase . Only the party with the phase information can retrieve the correct output . Without it , any party can neither recover the input nor the output . Tested on various datasets and DNNs , our method has been shown to yield only moderate computational overhead and little accuracy degradation , while significantly diminishes the adversary ’ s ability of inferring about the input . 2 RELATED WORK . Complex-valued neural networks . Using complex-valued features or parameters in neural networks has always been an interesting topic . From the computational perspective , Trabelsi et al . ( 2018 ) showed that complex-valued neural networks have a competitive performance with their real-valued counterparts . By augmenting recurrent neural networks with associative memory based on complexvalued vectors , Danihelka et al . ( 2016 ) achieved faster learning on memorization tasks . Complexvalued features can contain information in both the phase and the magnitude . An example is that Reichert & Serre ( 2013 ) used the phase to indicate properties of spike timing in cortical information processing . Zhang et al . ( 2019 ) used the quaternion-valued neural network to learn 3D-rotationequivariant features for 3D point cloud processing . We take advantage of complex-valued features such that original features can be hidden in an unknown phase . Also , Yang et al . ( 2019 ) shared a similar transformation-based approach as ours while it performed transformation on inputs rather than features , and it aimed to improve the adversarial robustness of the model . Privacy-preserving deep learning . Various privacy-preserving mechanisms have been proposed using different definitions of privacy : Osia et al . ( 2017 ) applied the Siamese architecture to separate the primary and private information so that the primary information was preserved in the feature . PrivyNet by Li et al . ( 2017 ) was proposed to decide the local DNN structure under the privacy constraint based on the peak signal-to-noise ratio or the pixel-wise Euclidean distance . Data nullification and random noise addition were introduced by Wang et al . ( 2018 ) to protect private information in the features , which guaranteed differential privacy . Cryptographic tools have been used to learn from sensitive data . Zhang et al . ( 2016 ) adopted homomorphic encryption , in particular , BGV encryption , to encrypt the private data and perform the high-order back-propagation on the encrypted data ; Mohassel & Zhang ( 2017 ) distributed the private data among two non-colluding servers who performed the secure two-party computation to train models on the joint data . Our scheme achieves k-anonymity privacy guarantee such that any adversary can at best reconstruct a number of synthetic inputs from the transformed features and thus it can not distinguish the original input from others . 3 THREAT MODEL AND PRIVACY GUARANTEE . In this section , we briefly introduce the threat model and the privacy guarantee that our scheme aims to achieve . Threat model . In our model , a user processes its raw data locally and transmits the neural network features to the cloud for further processing . An adversary would intercept the transferred features and perform either feature inversion attacks or property inference attacks on these features to either reconstruct inputs , or infer unintended information . Typical examples of the former attacks include feature inversion by Dosovitskiy & Brox ( 2016 ) , gradient-based visualization by Zeiler & Fergus ( 2014 ) ; Mahendran & Vedaldi ( 2015 ) , etc . And the latter ones include membership inference attack by Shokri et al . ( 2017 ) , passive property inference attack by Ganju et al . ( 2018 ) as well as feature leakage in collaborative learning by Melis et al . ( 2019 ) . k-anonymity . We aim to achieve the following privacy guarantee : when an adversary tries to reconstruct the original input from the transformed features , it can sythesize inputs belonging to k different prototypes with equivalent likelihoods , and only one of them corresponds to the original input . 4 APPROACH . 4.1 OVERVIEW . To fight against the above threats , we propose to revise the conventional DNN . The new structure is shown in Fig . 1a , where the entire network is divided into the following three modules . • Encoder is embedded inside a local device at the user end . The encoder extracts feature from the input , hides true feature by rotating the features by a randomized angle , and sends the encoded result to the cloud . • Processing module is located at the public cloud . This module receives and processes the encoded features without knowing the rotation . At the end of processing , the cloud returns the output to the user . • Decoder resides at the user ’ s local device . The decoder receives and decodes results sent from the cloud to obtain the final result . The three modules are jointly trained . Once trained , the encoder and decoder are placed at the local device , whereas the processing module resides on the cloud for public use . We will illustrate the detail of each module in the following section . 4.2 COMPLEX-VALUED NEURAL NETWORKS . Let ( I , y ) ∈ D denote an input and its label in the training dataset and g be the encoder at the local device . Given the input I , the intermediate-layer feature is computed as a = g ( I ) , ( 1 ) but we do not directly submit a to the cloud . Instead , we introduce a fooling counterpart b to construct a complex-valued feature as follows : x = exp ( iθ ) [ a+ bi ] , ( 2 ) where θ and b are randomly chosen . b is the fooling counterpart which does not contain any private information of a , but its magnitude is comparable with a to cause obfuscation . The encoded feature is then sent to the processing module Φ , which produces the complex-valued feature h = Φ ( x ) . Upon receiving h , the decoder makes prediction ŷ on I by inverting the complex-valued feature h back : ŷ = d ( < [ h · exp ( −iθ ) ] ) , ( 3 ) where d denotes the decoder module , which can be constructed as either a shallow network or just a softmax layer . < ( · ) denotes the operation of picking real parts of complex values . Processing Module Φ . The core design of the processing module is to allow the complex-valued feature h = Φ ( x ) to be successfully decoded later by the decoder . I.e . if we rotate the complexvalued feature a + bi by an angle θ , all the features of the following layers are supposed to be rotated by the same angle . We represent the processing module as cascaded functions of multiple layers Φ ( x ) = Φn ( Φn−1 ( · · ·Φ1 ( x ) ) ) , where Φj ( · ) denotes the function of the j-th layer and fj = Φj ( fj−1 ) represents the output of the j-th layer . Thus the processing module should have the following property : Φ ( f ( θ ) ) = eiθΦ ( f ) s.t . f ( θ ) , eiθf , ∀θ ∈ [ 0 , 2π ) . ( 4 ) In other words , the function of each intermediate layer in the processing module should satisfy Φj ( f ( θ ) j−1 ) = e iθΦj ( fj−1 ) s.t . f ( θ ) j−1 , e iθfj−1 , ∀j ∈ [ 2 , . . . , n ] , ∀θ ∈ [ 0 , 2π ) . ( 5 ) to recursively prove Eqn . ( 4 ) . Let us consider six most common types of network layers to construct the processing module , i.e . the convolutional layer , the ReLU layer , the batch-normalization layer , the average/max pooling layer , the dropout layer , and the skip-connection operation . For the convolutional layer , we remove the bias term and obtain Conv ( f ) = w ⊗ f , which satisfies Eqn . ( 5 ) . Inspired by Trabelsi et al . ( 2018 ) , we replace the ReLU with the following non-linear layer : δ ( fijk ) = ‖fijk‖ max { ‖fijk‖ , c } · fijk ( 6 ) where fijk denotes the neural activation at the location ( i , j ) in the k-th channel of the feature , and c is a positive constant . Likewise , the batch-normalization operation is replaced by norm ( f lijk ) = f lijk√ El [ ‖f lijk‖2 ] , ( 7 ) where f l denotes the complex-valued tensor for the l-th sample in the batch . For max-pooling layers , we modify the rule such that the feature with the maximum norm in the region is selected , which ensures that max-pooling does not change the phase of its input . For the dropout layer , we randomly drops out both the real and imaginary parts of complex-valued features . Skip connections can be formulated as f + Φ ( f ) , where the inner module Φ ( f ) recursively satisfies Eqn . ( 4 ) . All above six operations satisfy Eqn . ( 4 ) . Please see supplementary materials for the proof . GAN-based Encoder . The objective of the encoder is to hide the real feature a of the input I in a certain phase θ of the encoded feature x = exp ( iθ ) [ a + bi ] . Let a′ = < [ x exp ( −iθ′ ) ] = < [ ( a+ bi ) exp ( iθ − iθ′ ) ] = < [ ( a+ bi ) exp ( i∆θ ) ] denote a feature decoded using a random angle θ′ 6= θ , where ∆θ = θ − θ′ . An ideal encoder requires ( i ) the decoded feature a′ contains sufficient information to cause obfuscation with the real feature a ; ( ii ) a′ and a follow the same distribution so that it is hard to distinguish which one is the real one . Hence , we train the encoder g with a range of ∆θ ’ s and b ’ s , and adopt a GAN to distinguish different values of them . Letting D denote the discriminator , we train the encoder g over the WGAN ( Arjovsky et al . ( 2017 ) ) loss : min g max D L ( g , D ) = EI∼pI [ D ( a ) − E∆θ∼U ( 0 , π ) , b 6=a [ D ( a′ ) ] ] = EI∼pI [ D ( g ( I ) ) − E∆θ∼U ( 0 , π ) , b 6=g ( I ) [ D ( < [ ( g ( I ) + bi ) ei∆θ ] ) ] ] . ( 8 ) g generates features to fool D. Upon convergence , the distribution of a′ approximates that of a . Note that the loss is the expectation over uniform-randomly distributed θ ∈ ( 0 , 2π ) . Ideally , the expectation in Eqn . ( 8 ) should also be taken over all possible ∆θ 6= 0 , and thus when an adversary tries to recover a by randomly rotating an angle , it will generate an infinite number of features following the same distribution as that of a. Empirically , we pick k − 1 such ∆θ ’ s uniformly over ( 0 , π ) and iterate through these k − 1 values as negative samples in the adversarial learning . The GAN-based encoder is the key to our k-anonymity guarantee such that it ensures the real feature can not be distinguished from at least k − 1 synthetic features . Please find the end of Appendix B to see the visualization effect of our privacy guarantee . The overall loss of learning is formulated as follows , which contains the adversarial loss in Eqn . ( 8 ) and a loss for the target task : min g , Φ , d max D Loss = min g , Φ , d [ max D L ( g , D ) + Ltask ( ŷ , y ) ] , ( 9 ) where Ltask ( ŷ , y ) represents the loss for the target task . Note that to simplify the implementation , we compute b = g ( I ′ ) as the feature of a randomly chosen sample I ′ 6= I where ideally I ′ has little correlation with I . In sum , the entire neural network [ g , Φ , d ] is trained with randomized variables θ and b to minimize the loss in Eqn . ( 9 ) . Once trained , the network [ g , Φ , d ] is fixed and publicly released . At the inference phase , the encoder secretly selects a fooling counterpart b and a rotation angle θ to encode its real feature a . The decoder receives the processed result h from the cloud , and make the final prediction based on Eqn . ( 3 ) .

Summary: In this paper, the authors propose to hide information in phase of the input features. They proposed that if each layer of processing layer, sitting outside of the local unit, is phase preserving, then they can recover the phase back. They propose a modification to the most popular layers in DNN to satisfy that property.