CaPC Learning: Confidential and Private Collaborative Learning

Machine learning benefits from large training datasets , which may not always be possible to collect by any single entity , especially when using privacy-sensitive data . In many contexts , such as healthcare and finance , separate parties may wish to collaborate and learn from each other ’ s data but are prevented from doing so due to privacy regulations . Some regulations prevent explicit sharing of data between parties by joining datasets in a central location ( confidentiality ) . Others also limit implicit sharing of data , e.g. , through model predictions ( privacy ) . There is currently no method that enables machine learning in such a setting , where both confidentiality and privacy need to be preserved , to prevent both explicit and implicit sharing of data . Federated learning only provides confidentiality , not privacy , since gradients shared still contain private information . Differentially private learning assumes unreasonably large datasets . Furthermore , both of these learning paradigms produce a central model whose architecture was previously agreed upon by all parties rather than enabling collaborative learning where each party learns and improves their own local model . We introduce Confidential and Private Collaborative ( CaPC ) learning , the first method provably achieving both confidentiality and privacy in a collaborative setting . We leverage secure multiparty computation ( MPC ) , homomorphic encryption ( HE ) , and other techniques in combination with privately aggregated teacher models . We demonstrate how CaPC allows participants to collaborate without having to explicitly join their training sets or train a central model . Each party is able to improve the accuracy and fairness of their model , even in settings where each party has a model that performs well on their own dataset or when datasets are not IID and model architectures are heterogeneous across parties.1 1 INTRODUCTION . The predictions of machine learning ( ML ) systems often reveal private information contained in their training data ( Shokri et al. , 2017 ; Carlini et al. , 2019 ) or test inputs . Because of these limitations , legislation increasingly regulates the use of personal data ( Mantelero , 2013 ) . The relevant ethical ∗Equal contributions , authors ordered alphabetically . †Work done while the author was at Vector Institute . ‡Equal contributions , authors ordered alphabetically . 1Code is available at : https : //github.com/cleverhans-lab/capc-iclr . to evaluate Enc ( q ) onMi and outputs encrypted logits Enc ( ri ) . 1b Each answering party , Pi , generates a random vector r̂i , and sends Enc ( ri − r̂i ) to the querying party , Pi∗ , who decrypts to get ri − r̂i . 1c Each answering party Pi runs Yao ’ s garbled circuit protocol ( Yi ) with querying party Pi∗ to get si for Pi∗ and ŝi for Pi s.t . si + ŝi is the one-hot encoding of argmax of logits . 2 Each answering party sends ŝi to the privacy guardian ( PG ) . The PG sums ŝi from each Pi and adds Laplacian or Gaussian noise for DP . The querying party sums si from each Yi computation . 3 The PG and the querying party run Yao ’ s garbled circuit Ys to obtain argmax of querying party and PG ’ s noisy share . The label is output to the querying party . concerns prompted researchers to invent ML algorithms that protect the privacy of training data and confidentiality of test inputs ( Abadi et al. , 2016 ; Konečnỳ et al. , 2016 ; Juvekar et al. , 2018 ) . Yet , these algorithms require a large dataset stored either in a single location or distributed amongst billions of participants . This is the case for example with federated learning ( McMahan et al. , 2017 ) . Prior algorithms also assume that all parties are collectively training a single model with a fixed architecture . These requirements are often too restrictive in practice . For instance , a hospital may want to improve a medical diagnosis for a patient using data and models from other hospitals . In this case , the data is stored in multiple locations , and there are only a few parties collaborating . Further , each party may also want to train models with different architectures that best serve their own priorities . We propose a new strategy that lets fewer heterogeneous parties learn from each other collaboratively , enabling each party to improve their own local models while protecting the confidentiality and privacy of their data . We call this Confidential and Private Collaborative ( CaPC ) learning . Our strategy improves on confidential inference ( Boemer , 2020 ) and PATE , the private aggregation of teacher ensembles ( Papernot et al. , 2017 ) . Through structured applications of these two techniques , we design a strategy for inference that enables participants to operate an ensemble of heterogeneous models , i.e . the teachers , without having to explicitly join each party ’ s data or teacher model at a single location . This also gives each party control at inference , because inference requires the agreement and participation of each party . In addition , our strategy provides measurable confidentiality and privacy guarantees , which we formally prove . We use the running example of a network of hospitals to illustrate our approach . The hospitals participating in CaPC protocol need guarantees on both confidentiality ( i.e. , data from a hospital can only be read by said hospital ) and privacy ( i.e. , no hospital can infer private information about other hospitals ’ data by observing their predictions ) . First , one hospital queries all the other parties over homomorphic encryption ( HE ) , asking them to label an encrypted input using their own teacher models . This can prevent the other hospitals from reading the input ( Boemer et al. , 2019 ) , an improvement over PATE , and allows the answering hospitals to provide a prediction to the querying hospital without sharing their teacher models . The answering hospitals use multi-party computation ( MPC ) to compute an aggregated label , and add noise during the aggregation to obtain differential privacy guarantees ( Dwork et al. , 2014 ) . This is achieved by a privacy guardian ( PG ) , which then relays the aggregated label to the querying hospital . The PG only needs to be semi-trusted : we operate under the honest-but-curious assumption . The use of MPC ensures that the PG can not decipher each teacher model ’ s individual prediction , and the noise added via noisy argmax mechanism gives differential privacy even when there are few participants . This is a significant advantage over prior decentralized approaches like federated learning , which require billions of participants to achieve differential privacy , because the sensitivity of the histogram used in our aggregation is lower than that of the gradients aggregated in federated learning . Unlike our approach , prior efforts involving few participants thus had to prioritize model utility over privacy and only guarantee confidentiality ( Sheller et al. , 2020 ) . Finally , the querying hospital can learn from this confidential and private label to improve their local model . Since the shared information is a label rather than a gradient , as used by federated learning , CaPC participants do not need to share a common model architecture ; in fact , their architectures can vary throughout the participation in the protocol . This favors model development to a degree which is not possible in prior efforts such as federated learning . We show how participants can instantiate various forms of active and online learning with the labels returned by our protocol : each party participating in the CaPC protocol may ( a ) identify deficiencies of its model throughout its deployment and ( b ) finetune the model with labels obtained by interacting with other parties . Intuitively , we achieve the analog of a doctor querying colleagues for a second opinion on a difficult diagnostic , without having to reveal the patient ’ s medical condition . This protocol leads to improvements in both the accuracy and fairness ( when there is a skew in the data distribution of each participating hospital ) of model predictions for each of the CaPC participants . To summarize , our contributions are the following : • We introduce CaPC learning : a confidential and private collaborative learning platform that provides both confidentiality and privacy while remaining agnostic to ML techniques . • Through a structured application of homomorphic encryption , secure MPC , and private aggregation , we design a protocol for CaPC . We use two-party deep learning inference and design an implementation of the noisy argmax mechanism with garbled circuits . • Our experiments on SVHN and CIFAR10 demonstrate that CaPC enables participants to collaborate and improve the utility of their models , even in the heterogeneous setting where the architectures of their local models differ , and when there are only a few participants . • Further , when the distribution of data drifts across participating parties , we show that CaPC significantly improves fairness metrics because querying parties benefit from knowledge learned by other parties on different data distributions , which is distilled in their predictions . • We release the source code for reproducing all our experiments . 2 BACKGROUND . Before introducing CaPC , we first go over elements of cryptography and differential privacy that are required to understand it . Detailed treatment of these topics can be found in Appendices A and B . 2.1 CRYPTOGRAPHIC PRELIMINARIES FOR CONFIDENTIALITY . The main cryptographic tool used in CaPC is secure multi-party computation ( MPC ) ( Yao , 1986 ) . MPC allows a set of distrusting parties to jointly evaluate a function on their input without revealing anything beyond the output . In general , most practical MPC protocols can be classified into two categories : 1 ) generic MPC protocols that can compute any function with the above security goal ( Malkhi et al. , 2004 ) ; and 2 ) specialized MPC protocols that can be used to compute only selected functions ( e.g. , private set intersection ( Pinkas et al. , 2020 ) , secure machine learning ( Mohassel & Zhang , 2017 ) ) . Although specialized MPC protocols are less general , they are often more efficient in execution time . Protocols in both categories use similar cryptographic building blocks , including ( fully ) homomorphic encryption ( Gentry , 2009 ) , secret sharing ( Shamir , 1979 ) , oblivious transfer ( Rabin , 2005 ) , garbled circuits ( Yao , 1986 ) . To understand our protocol , it is not necessary to know all details about these cryptographic building blocks and thus we describe them in Appendix A.1 . Our work uses these cryptographic preliminaries for secure computation at prediction time , unlike recent approaches , which explore new methods to achieving confidentiality at training time ( Huang et al. , 2020a ; b ) . The cryptographic protocol designed in this paper uses a specialized MPC protocol for securely evaluating a private ML model on private data , and a generic two-party computation protocol to compute an argmax in different forms . For the generic two-party computation , we use a classical Yao ’ s garbled-circuit protocol that can compute any function in Boolean circuit . For secure classification of neural networks , our protocol design is flexible to work with most existing protocols ( Boemer et al. , 2020 ; 2019 ; Gilad-Bachrach et al. , 2016 ; Mishra et al. , 2020 ) . Most existing protocols are different in how they handle linear layers ( e.g . convolution ) and non-linear layers ( e.g . ReLU ) . For instance , one can perform all computations using a fully homomorphic encryption scheme resulting in low communication but very high computation , or using classical MPC techniques with more communication but less computation . Other works ( Juvekar et al. , 2018 ) use a hybrid of both and thus enjoy further improvement in performance ( Mishra et al. , 2020 ) . We discuss it in more details in Appendix A.2 .

Summary: The authors combine several cryptographic techniques to create a federated systems that allows several entities to run classification against all the model held be the participants without revealing information in the process. In particular, the sample to be classified is not revealed to any other party, and differential privacy is used to protect the training data that was used to train the models. A central semi-honest coordinator is used to aggregate the results and add the differential privacy without learning any private information.