Interpretable Complex-Valued Neural Networks for Privacy Protection

1 INTRODUCTION . Deep neural networks ( DNNs ) have shown superb capabilities to process massive volume of data , and local devices such as mobile phones , medical equipment , Internet of Things ( IoT ) devices have become major data entry points in recent years . Although on-device machine learning has exhibited various advantages , it usually burdens thin devices with overwhelming computational overhead . Yet offloading data or processed features to a cloud operator would put the individual privacy at risk . For example , if a user has a virtual assistant at home , it should not worry about its private data being collected and processed by an untrusted cloud operator . The operator , on the other hand , should not be able to recover original signals or their interpretation . However , as shown in the previous literature ( Dosovitskiy & Brox ( 2016 ) ; Zeiler & Fergus ( 2014 ) ; Mahendran & Vedaldi ( 2015 ) ; Shokri et al . ( 2017 ) ; Ganju et al . ( 2018 ) ; Melis et al . ( 2019 ) ) , intermediatelayer features face many privacy threats , where the adversary either reconstructs the input or infers unintended properties about the input . Hence , on-device processing encounters a dilemma , i.e . while we expect intermediate-layer features to yield high accuracy , we certainly would not want sensitive information to be leaked . Therefore , we propose a novel method which tweaks a conventional neural network into a complexvalued one , such that intermediate-layer features are released without sacrificing input privacy too much . More precisely , we turn the original real-valued features into complex-valued ones , rotate these features by a random angle , and feed them to the cloud for further processing . We face two significant challenges in the design . First , the tweaked features have to be correctly handled by the DNN on the cloud . Although network structures vary depending on the input types , it is desired that the piecewise linearity of features to be preserved , so that the resulting accuracy does not degrade too much compared with the original features . Second , an adversary attacker who intercepts the features in the middle should not be able to recover the exact input , nor can it figure out the correct output . Most importantly , the neural network is supposed to be trained using the original data without additional human supervision , and is efficient to conduct inference . ∗Quanshi Zhang is the corresponding author with the John Hopcroft Center and MoE Key Lab of Artificial Intelligence AI Institute , Shanghai Jiao Tong University , China . zqs1022 @ sjtu.edu.cn To overcome the first challenge , we tailor operations of DNN to make the succeeding computation at the cloud invariant to feature rotations , i.e. , the DNN can correctly handle the feature and preserve the rotated angle in the output . For the second issue , we adopt generative adversarial networks ( GAN ) to generate synthesized features to hide the original ones . It guarantees k-anonymity such that , when an adversary tries to recover the original input from the complex-valued features , it would get at least k different inputs ( Please see Appendix B for detailed discussion ) . Each of the k reconstructed inputs has equivalent probabilities of being the original input for the attacker . Apart from the GAN part , the training of the neural network adds little additional computation overhead and requires no extra denotations . Contributions of this study can be summarized as follows . We propose to transform conventional DNNs into complex-valued ones , which hide input information into a randomly chosen phase . Only the party with the phase information can retrieve the correct output . Without it , any party can neither recover the input nor the output . Tested on various datasets and DNNs , our method has been shown to yield only moderate computational overhead and little accuracy degradation , while significantly diminishes the adversary ’ s ability of inferring about the input . 2 RELATED WORK . Complex-valued neural networks . Using complex-valued features or parameters in neural networks has always been an interesting topic . From the computational perspective , Trabelsi et al . ( 2018 ) showed that complex-valued neural networks have a competitive performance with their real-valued counterparts . By augmenting recurrent neural networks with associative memory based on complexvalued vectors , Danihelka et al . ( 2016 ) achieved faster learning on memorization tasks . Complexvalued features can contain information in both the phase and the magnitude . An example is that Reichert & Serre ( 2013 ) used the phase to indicate properties of spike timing in cortical information processing . Zhang et al . ( 2019 ) used the quaternion-valued neural network to learn 3D-rotationequivariant features for 3D point cloud processing . We take advantage of complex-valued features such that original features can be hidden in an unknown phase . Also , Yang et al . ( 2019 ) shared a similar transformation-based approach as ours while it performed transformation on inputs rather than features , and it aimed to improve the adversarial robustness of the model . Privacy-preserving deep learning . Various privacy-preserving mechanisms have been proposed using different definitions of privacy : Osia et al . ( 2017 ) applied the Siamese architecture to separate the primary and private information so that the primary information was preserved in the feature . PrivyNet by Li et al . ( 2017 ) was proposed to decide the local DNN structure under the privacy constraint based on the peak signal-to-noise ratio or the pixel-wise Euclidean distance . Data nullification and random noise addition were introduced by Wang et al . ( 2018 ) to protect private information in the features , which guaranteed differential privacy . Cryptographic tools have been used to learn from sensitive data . Zhang et al . ( 2016 ) adopted homomorphic encryption , in particular , BGV encryption , to encrypt the private data and perform the high-order back-propagation on the encrypted data ; Mohassel & Zhang ( 2017 ) distributed the private data among two non-colluding servers who performed the secure two-party computation to train models on the joint data . Our scheme achieves k-anonymity privacy guarantee such that any adversary can at best reconstruct a number of synthetic inputs from the transformed features and thus it can not distinguish the original input from others . 3 THREAT MODEL AND PRIVACY GUARANTEE . In this section , we briefly introduce the threat model and the privacy guarantee that our scheme aims to achieve . Threat model . In our model , a user processes its raw data locally and transmits the neural network features to the cloud for further processing . An adversary would intercept the transferred features and perform either feature inversion attacks or property inference attacks on these features to either reconstruct inputs , or infer unintended information . Typical examples of the former attacks include feature inversion by Dosovitskiy & Brox ( 2016 ) , gradient-based visualization by Zeiler & Fergus ( 2014 ) ; Mahendran & Vedaldi ( 2015 ) , etc . And the latter ones include membership inference attack by Shokri et al . ( 2017 ) , passive property inference attack by Ganju et al . ( 2018 ) as well as feature leakage in collaborative learning by Melis et al . ( 2019 ) . k-anonymity . We aim to achieve the following privacy guarantee : when an adversary tries to reconstruct the original input from the transformed features , it can sythesize inputs belonging to k different prototypes with equivalent likelihoods , and only one of them corresponds to the original input . 4 APPROACH . 4.1 OVERVIEW . To fight against the above threats , we propose to revise the conventional DNN . The new structure is shown in Fig . 1a , where the entire network is divided into the following three modules . • Encoder is embedded inside a local device at the user end . The encoder extracts feature from the input , hides true feature by rotating the features by a randomized angle , and sends the encoded result to the cloud . • Processing module is located at the public cloud . This module receives and processes the encoded features without knowing the rotation . At the end of processing , the cloud returns the output to the user . • Decoder resides at the user ’ s local device . The decoder receives and decodes results sent from the cloud to obtain the final result . The three modules are jointly trained . Once trained , the encoder and decoder are placed at the local device , whereas the processing module resides on the cloud for public use . We will illustrate the detail of each module in the following section . 4.2 COMPLEX-VALUED NEURAL NETWORKS . Let ( I , y ) ∈ D denote an input and its label in the training dataset and g be the encoder at the local device . Given the input I , the intermediate-layer feature is computed as a = g ( I ) , ( 1 ) but we do not directly submit a to the cloud . Instead , we introduce a fooling counterpart b to construct a complex-valued feature as follows : x = exp ( iθ ) [ a+ bi ] , ( 2 ) where θ and b are randomly chosen . b is the fooling counterpart which does not contain any private information of a , but its magnitude is comparable with a to cause obfuscation . The encoded feature is then sent to the processing module Φ , which produces the complex-valued feature h = Φ ( x ) . Upon receiving h , the decoder makes prediction ŷ on I by inverting the complex-valued feature h back : ŷ = d ( < [ h · exp ( −iθ ) ] ) , ( 3 ) where d denotes the decoder module , which can be constructed as either a shallow network or just a softmax layer . < ( · ) denotes the operation of picking real parts of complex values . Processing Module Φ . The core design of the processing module is to allow the complex-valued feature h = Φ ( x ) to be successfully decoded later by the decoder . I.e . if we rotate the complexvalued feature a + bi by an angle θ , all the features of the following layers are supposed to be rotated by the same angle . We represent the processing module as cascaded functions of multiple layers Φ ( x ) = Φn ( Φn−1 ( · · ·Φ1 ( x ) ) ) , where Φj ( · ) denotes the function of the j-th layer and fj = Φj ( fj−1 ) represents the output of the j-th layer . Thus the processing module should have the following property : Φ ( f ( θ ) ) = eiθΦ ( f ) s.t . f ( θ ) , eiθf , ∀θ ∈ [ 0 , 2π ) . ( 4 ) In other words , the function of each intermediate layer in the processing module should satisfy Φj ( f ( θ ) j−1 ) = e iθΦj ( fj−1 ) s.t . f ( θ ) j−1 , e iθfj−1 , ∀j ∈ [ 2 , . . . , n ] , ∀θ ∈ [ 0 , 2π ) . ( 5 ) to recursively prove Eqn . ( 4 ) . Let us consider six most common types of network layers to construct the processing module , i.e . the convolutional layer , the ReLU layer , the batch-normalization layer , the average/max pooling layer , the dropout layer , and the skip-connection operation . For the convolutional layer , we remove the bias term and obtain Conv ( f ) = w ⊗ f , which satisfies Eqn . ( 5 ) . Inspired by Trabelsi et al . ( 2018 ) , we replace the ReLU with the following non-linear layer : δ ( fijk ) = ‖fijk‖ max { ‖fijk‖ , c } · fijk ( 6 ) where fijk denotes the neural activation at the location ( i , j ) in the k-th channel of the feature , and c is a positive constant . Likewise , the batch-normalization operation is replaced by norm ( f lijk ) = f lijk√ El [ ‖f lijk‖2 ] , ( 7 ) where f l denotes the complex-valued tensor for the l-th sample in the batch . For max-pooling layers , we modify the rule such that the feature with the maximum norm in the region is selected , which ensures that max-pooling does not change the phase of its input . For the dropout layer , we randomly drops out both the real and imaginary parts of complex-valued features . Skip connections can be formulated as f + Φ ( f ) , where the inner module Φ ( f ) recursively satisfies Eqn . ( 4 ) . All above six operations satisfy Eqn . ( 4 ) . Please see supplementary materials for the proof . GAN-based Encoder . The objective of the encoder is to hide the real feature a of the input I in a certain phase θ of the encoded feature x = exp ( iθ ) [ a + bi ] . Let a′ = < [ x exp ( −iθ′ ) ] = < [ ( a+ bi ) exp ( iθ − iθ′ ) ] = < [ ( a+ bi ) exp ( i∆θ ) ] denote a feature decoded using a random angle θ′ 6= θ , where ∆θ = θ − θ′ . An ideal encoder requires ( i ) the decoded feature a′ contains sufficient information to cause obfuscation with the real feature a ; ( ii ) a′ and a follow the same distribution so that it is hard to distinguish which one is the real one . Hence , we train the encoder g with a range of ∆θ ’ s and b ’ s , and adopt a GAN to distinguish different values of them . Letting D denote the discriminator , we train the encoder g over the WGAN ( Arjovsky et al . ( 2017 ) ) loss : min g max D L ( g , D ) = EI∼pI [ D ( a ) − E∆θ∼U ( 0 , π ) , b 6=a [ D ( a′ ) ] ] = EI∼pI [ D ( g ( I ) ) − E∆θ∼U ( 0 , π ) , b 6=g ( I ) [ D ( < [ ( g ( I ) + bi ) ei∆θ ] ) ] ] . ( 8 ) g generates features to fool D. Upon convergence , the distribution of a′ approximates that of a . Note that the loss is the expectation over uniform-randomly distributed θ ∈ ( 0 , 2π ) . Ideally , the expectation in Eqn . ( 8 ) should also be taken over all possible ∆θ 6= 0 , and thus when an adversary tries to recover a by randomly rotating an angle , it will generate an infinite number of features following the same distribution as that of a. Empirically , we pick k − 1 such ∆θ ’ s uniformly over ( 0 , π ) and iterate through these k − 1 values as negative samples in the adversarial learning . The GAN-based encoder is the key to our k-anonymity guarantee such that it ensures the real feature can not be distinguished from at least k − 1 synthetic features . Please find the end of Appendix B to see the visualization effect of our privacy guarantee . The overall loss of learning is formulated as follows , which contains the adversarial loss in Eqn . ( 8 ) and a loss for the target task : min g , Φ , d max D Loss = min g , Φ , d [ max D L ( g , D ) + Ltask ( ŷ , y ) ] , ( 9 ) where Ltask ( ŷ , y ) represents the loss for the target task . Note that to simplify the implementation , we compute b = g ( I ′ ) as the feature of a randomly chosen sample I ′ 6= I where ideally I ′ has little correlation with I . In sum , the entire neural network [ g , Φ , d ] is trained with randomized variables θ and b to minimize the loss in Eqn . ( 9 ) . Once trained , the network [ g , Φ , d ] is fixed and publicly released . At the inference phase , the encoder secretly selects a fooling counterpart b and a rotation angle θ to encode its real feature a . The decoder receives the processed result h from the cloud , and make the final prediction based on Eqn . ( 3 ) .

Summary: This paper proposes a novel way to outsource a part of the information processing in a deep learning model to an untrusted remote location while revealing only little information about the input or final output of the computation. To this end the result of an on-chip encoder (e.g. the first N layers of a ConvNet) is encoded in a complex number with a random phase, which is then shipped to a remote location and gets processed (the next M layers of a ConvNet) in a way that is phase-equivariant. This result is shipped back to the device which extracts the desired information by inverting the phase randomisation. Additional distractor signals are encoded through a GAN-type approach.