Task-aware Privacy Preservation for Multi-dimensional Data

1 INTRODUCTION . In recent years , there has been a tremendous growth in the volume of available data for machine learning ( ML ) tasks , leading to increasing emphasis on protecting user privacy . Differential privacy ( DP ) ( Dwork et al. , 2006 ; 2014 ) is a state-of-the-art technique for data privacy , and its local variant – local differential privacy ( LDP ) ( Kasiviswanathan et al. , 2011 ) – provides stronger privacy guarantees for individual users without dependence on any trusted third party . In practice , LDP has been successfully deployed in products of companies like Google ( Erlingsson et al. , 2014 ) , Apple ( Differential Privacy Team ) , and Microsoft ( Ding et al. , 2017 ) for some basic frequency or histogram estimation tasks where raw user data is restricted to an n-bit discrete variable . In the future , LDP has the promising potential to be adopted in more complex scenarios ( Hassan et al. , 2019 ; Dankar & El Emam , 2013 ; Zhao et al. , 2014 ; Cortés et al. , 2016 ) ( e.g. , health care , power grids , Internet of Things ) that feature richer user data attributes that feed into more sophisticated downstream ML tasks . In such cases , today ’ s standard task-agnostic LDP approaches may not be ideal . For example , consider complex user data that must be anonymized before passing it into a ML task function , such as a neural network classifier for credit scores . A standard approach would be to simply perturb the data by adding artificial noise whose scale depends on the sensitivity of user data ( i.e . worst-case variation among a user population ) and a given privacy budget , regardless of what ultimate task the anonymized data will be used for . However , as the dimension and variability of user data inevitably grows , today ’ s methods would generally have to increase the scale of noise to provide the same LDP guarantee , even though many data attributes might be highly variable across a user population , but minimally relevant for a task . As a consequence , one often adds excessive noise to all data attributes , which can severely degrade an ultimate task ’ s performance . To address these challenges , this paper introduces a fundamentally different task-aware LDP approach . Our method improves the performance of ML tasks that operate on multi-dimensional user data while still guaranteeing the same levels of privacy . Our key technical insight is to characterize the dependence of task performance on various user data attributes , which guides how we learn a concise , task-relevant encoding ( i.e . latent representation ) of user data . Then , for the same privacy budget , we can directly expose and perturb only the task-relevant encoding rather than raw user data , which often allows us to add less noise and thereby improve task accuracy ( see Section 2 for a concrete example ) . Crucially , user privacy is guaranteed under the same privacy budget according to the post-processing immunity of DP ( Dwork et al. , 2014 ) ( i.e. , one can not make the output of a privacy algorithm less differentially private without additional knowledge ) . As such , an adversary can not decode the anonymized latent representation to reduce the level of privacy . Our method allows us to learn and expose only high-valued data attributes and flexibly adjust their signal-to-noise ratio based on their importance to a task . Moreover , when different data attributes are inter-dependent , task-aware LDP preservation is even more promising in that we can consider the utilities of the underlying orthogonal bases through principal component analysis ( PCA ) ( Dunteman , 1989 ) , instead of the raw data attributes . Contributions . In light of prior work , our contributions are three-fold . First , we propose a taskaware privacy preservation problem in which the effect of noise perturbation to preserve LDP is effectively considered , based on an encoder-decoder framework ( Section 3 ) . Second , in terms of task-aware privacy preservation , we obtain an analytical near-optimal solution for a linear setting and MSE task loss , and provide a heuristic learning algorithm for more general settings ( Section 4 ) . Third , we validate the effectiveness of our task-aware approach through three real-world experiments , which show our task-aware approach outperforms the benchmark approaches on overall task loss under various LDP budgets by as much as 73.0 % ( Section 5 ) . All the proofs are given in the Appendix . Related Work . 1 ) Utility maximization in DP/LDP . Most theoretical DP/LDP research either provides a utility upper bound for a given privacy budget under some weak assumptions ( Alvim et al. , 2011 ; Kenthapadi et al. , 2012 ; Duchi et al. , 2013 ; Makhdoumi & Fawaz , 2013 ; Hardt & Talwar , 2010 ; Wang et al. , 2019b ; Acharya et al. , 2020 ) , or designs optimal privacy preservation mechanisms in some specific use cases ( McSherry & Talwar , 2007 ; Wasserman & Zhou , 2010 ; Friedman & Schuster , 2010 ; Xiao et al. , 2010 ; Thakurta & Smith , 2013 ; Kairouz et al. , 2014 ; Geng & Viswanath , 2015 ; Liu et al. , 2016 ; Yiwen et al. , 2018 ; Joseph et al. , 2019 ; Gondara & Wang , 2020 ; Wang et al. , 2020 ) . To the best of our knowledge , with respect to multi-dimensional user data , Murakami & Kawamoto ( 2019 ) , Wang et al . ( 2019a ) and Chen et al . ( 2021 ) are the only three similar works to ours . Murakami & Kawamoto ( 2019 ) develops a utility-maximizing LDP framework under the assumption that some data attributes may not be privacy-sensitive , and hence the utility improvement is mainly achieved by providing privacy guarantees for only a subset of attributes . Wang et al . ( 2019a ) mainly focuses on developing novel LDP mechanisms for multi-dimensional data with an objective of minimizing the worst-case noise variance , which naturally improves utility . Chen et al . ( 2021 ) preserves DP for images by adding noise to a latent representation learned through back-propagation of task loss , where the effect of noise perturbation is not considered . The key differences of our work are : i ) we don ’ t make additional assumptions on the sensitivity of user data , ii ) our task-aware approach achieves a better task performance than standard LDP benchmarks by directly studying the dependencies between the task objective and different attributes of user data , and iii ) we effectively capture the effect of noise perturbation resulting from privacy requirements . 2 ) End-to-end ( E2E ) learning . There has been a wide variety of works training a cascade of deep neural networks ( DNNs ) through E2E learning , where a task-specific output is directly predicted from the raw inputs ( Muller et al. , 2006 ; Wang et al. , 2012 ; Donti et al. , 2017 ; Zhou & Tuzel , 2018 ; Amos et al. , 2018 ) . Our work also follows such a practice , but introduces an LDP guarantee while improving the task performance . 3 ) DP in deep learning . The popularity of deep learning also draws great attention to DP preservation therein ( Song et al. , 2013 ; Shokri & Shmatikov , 2015 ; Abadi et al. , 2016 ; Phan et al. , 2016 ; Papernot et al. , 2016 ; Phan et al. , 2017 ; McMahan et al. , 2018 ; Wang et al. , 2018 ; Phan et al. , 2019 ; Arachchige et al. , 2019 ; Liu et al. , 2020 ; Mireshghallah et al. , 2020 ; Bu et al. , 2020 ) . Our work is fundamentally different . Instead of preserving LDP during the learning process , we use learning as a tool to find the salient representation that improves the task performance under a given privacy budget . In other words , we don ’ t perturb the gradient for backpropagation but perturb the representation to guarantee LDP . Furthermore , we don ’ t specifically deal with privacy preservation during the offline training process , which requires some ground truth user data ( e.g. , from a small set of consenting volunteers ) . However , LDP of user data is guaranteed after a trained model is deployed online . 2 BACKGROUND AND MOTIVATING EXAMPLE . -LDP ( Kasiviswanathan et al. , 2011 ) . Let x ∈ Rn be an individual data sample , and X be the domain of x , which is assumed to be a compact subset of Rn . A randomized algorithmM : X 7→ Rd is said to satisfy -LDP with privacy-budget > 0 , if Pr [ M ( x ) ∈ S ] ≤ e Pr [ M ( x′ ) ∈ S ] , ∀x , x′ ∈ X , S ⊆ imM . ( 1 ) Essentially , when is small , one can not readily differentiate whether the input ofM is an individual user x or x′ based onM ’ s outcome . Laplace mechanism ( Dwork et al. , 2014 ) . To release a sensitive function g : X 7→ Rd under -LDP , ∀ > 0 , the Laplace mechanism is a widely used mechanism which adds Laplace noise to function g : MLap ( x , g , ) = g ( x ) + Lapd ( µ = 0 , b = ∆1g ) , ( 2 ) where Lapd ( µ , b ) is a d-dimensional vector whose elements are i.i.d . Laplace random variables with mean µ and scale b , which leads its variance to be 2b2 . For concreteness , the analysis and evaluation of this paper focus on the Laplace mechanism although the central idea of learning taskrelevant data representations is applicable to other random privacy mechanisms as well . ∆1g = maxx , x′∈X ‖g ( x ) − g ( x′ ) ‖1 measures the sensitivity of g under the ` 1 norm . A motivating example . Consider an example shown in Fig . 1 . For simplicity , we only consider an example with two people , Alice and Bob , and two data attributes , age and wage . Suppose we need to preserve -LDP for each person with = 1 and our task is to estimate the mean wage as closely as possible . A straightforward taskagnostic approach will directly expose both the two data attributes , and add Laplace noise with scale b = 20 to each attribute . However , a task-aware approach will expose only the wage attribute and add Laplace noise with scale b = 10 . Both the approaches guarantee LDP under the same budget ( = 1 ) , but the wage attribute given by the task-aware approach is less noisy , and we can expect that the corresponding estimated mean wage ( i.e . the ultimate task objective ) is close to the real value with a higher probability . In more complex scenarios , such as when each data attribute is not redundant but is valued differently in terms of the considered task or data attributes are dependent but not perfectly correlated , etc. , the optimal solution will not be as straightforward as the given example and will be explored in the following sections . 3 PROBLEM FORMULATION . We now introduce the task-aware privacy preservation problem depicted in Fig . 2 . Let y = f ( x ) ∈ Rm denote the task output associated with each ground truth data sample x , where f represents the task function . To guarantee -LDP for each data sample x , its true value should never be exposed to the task function . Instead , an estimate of x , denoted by x̂ , is used as the input to the task function with the corresponding task output ŷ = f ( x̂ ) . The objective is to minimize the overall task loss L = E [ l ( ŷ , y ) ] due to the difference between x̂ and x , where x follows distribution Dx , and l is a task loss function that captures the discrepancy between task output ŷ and y , such as the common ` 2 and cross-entropy loss . More concretely , x is first mapped to a latent representation φ ∈ RZ through an encoder function φ = ge ( x ; θe ) , where θe are a set of encoder parameters . φ is then perturbed by a Laplace noise vector w ∈ RZ . That is , ge is treated as the sensitive function g in Eq.2 . Next , x̂ is reconstructed from φ+ w using a decoder function x̂ = gd ( φ+ w ; θd ) where θd are a set of decoder parameters . Note that in reality the encoder is deployed at the end of each individual user and in general has to be lightweight ( e.g. , linear or one hidden-layer neural network ) . The optimal task-aware x̂ minimizes L while preserving -LDP . In other words , the task-aware privacy preservation problem aims to co-design encoder and decoder , i.e. , find proper values for Z , θe and θd , such that L is minimized and -LDP is preserved . Formally , min Z , θe , θd L = Ex , w [ l ( ŷ , y ) ] , ( 3 ) s.t . y = f ( x ) , ( 4 ) ŷ = f ( gd ( ge ( x ; θe ) + w ; θd ) ) , ( 5 ) x ∼ Dx , w ∼ LapZ ( 0 , ∆1ge ) . ( 6 ) The difficulty of our task-aware LDP problem mainly comes from the discrepancy of the measurement of overall task loss L , which depends on Dx and captures the average performance , and the mechanism of preserving LDP , which depends on X and focuses only on the worst-case privacy guarantee . Benchmarks . We now describe two natural approaches to preserve -LDP . First , a task-agnostic approach adds noise directly to the normalized x1 . For convenience we assume x is already normalized , and we have Z = n and ge ( x ) = x . Second , a privacy-agnostic approach adds noise to φ obtained by considering the problem defined in Eq.3-6 with a pre-determined Z ≤ n and w being a zero vector instead . That is , the privacy-preservation part is neglected when designing the encoder , and hence a proper Z needs to be pre-determined or one would always conclude a larger Z ( under which more information can be delivered when noise is absent ) is better . Both two benchmark approaches still need to determine the optimal decoder parameters θd for input φ + w. Note that for the task-agnostic approach even though ge is an identity function , the corresponding optimal gd is usually not an identity function , as exemplified in Section A.7.1 .

Summary: This paper proposes a task-aware local DP method to improve the privacy andutility trade-off for multi-dimensional user data. Also, a analytical near-optimal solution for a general linear encoder-decoder model and MSE loss is provided. For neural network cases (i.e., nonlinear encoder-decoder), the authors present a heuristic learning algorithm to get the model parameters. The experiments results demonstrate the effectiveness of the proposed methods.