Multi-Trigger-Key: Towards Multi-Task Privacy-Preserving In Deep Learning

1 INTRODUCTION . Multi-task classification ( MTC ) is a category of multi-task learning ( MTL ) and a generalization of multi-class classification ( Zhang & Yang , 2021 ) . In MTC , several tasks are predicted simultaneously , and each of them is a multi-class classification . The state of the art in MTC has been dramatically improved over the past decade thanks to deep learning ( Ruder , 2017 ; Huang & Stokes , 2016 ; Liu et al. , 2016 ) . Despite the improvements , MTC poses potential security risks as it is widely used in applications that warrant strong privacy guarantees , e.g. , visual attributes ( Sarafianos et al. , 2017 ) and healthcare ( Amyar et al. , 2020 ) . Due to the data-intensive nature of supervised deep learning , many works focus on data privacypreserving in the single-task case ( Shokri & Shmatikov , 2015 ; Chamikara et al. , 2020 ) . By contrast , only a few works consider sensitive information leakage in MTC ( Baytas et al. , 2016 ; Liu et al. , 2018 ; Pathak et al. , 2010 ; Gupta et al. , 2016 ; Liang et al. , 2020 ) . Among existing works , widely used techniques include distributed optimization methods ( Baytas et al. , 2016 ; Liu et al. , 2018 ) and differential privacy that masks the original datasets/intermediate results with some noise perturbation mechanisms during the training process ( Pathak et al. , 2010 ; Gupta et al. , 2016 ; Liang et al. , 2020 ) . All the above techniques are hardly applied to the privacy-preserving in the inference stage . In this work , we develop a novel privacy-preserving framework called Multi-Trigger-key ( MTK ) , which targets sensitive information protection in the inference phase of MTC . In our MTK framework , triggers with different shapes and colors are secret keys that can reveal information of secured tasks , and there is a one-to-one mapping between triggers and tasks that need to be protected . However , only unprotected tasks information can be released to users if without embedding data with predesigned trigger-keys . Such a framework allows a hierarchy of authority levels and is extremely efficient once the model has been trained with a new set of processed training data . Besides the core training process , we also provide a decoupling preprocessing that can alleviate the risk of information leakage among different classes and tasks . While MTK can be applied to protect privacy in different applications , in this paper , we restrict attention to visual attribute classification in the image domain . Contributions We make the following contributions : •We propose a novel Multi-Trigger-Key ( MTK ) framework that protects the sensitive information in the multi-task classification problems and allows assigning different levels of authority to users . • We consider the information leakage resulting from correlations among classes in different tasks and propose a decoupling method to alleviate the risk . • We conduct a comprehensive study of the MTK on the UTKFace dataset ( Zhang et al. , 2017 ) , showing that MTK can simultaneously protect secured tasks and maintain the prediction accuracy of all tasks . 1.1 RELATED WORK . Multi-task learning ( MTL ) . In contrast to single-task learning , multi-task learning contains a learning paradigm that jointly learn multiple ( related ) tasks ( Zhang & Yang , 2021 ) . A crucial assumption for MTL is that features are largely shared across all tasks which enable models to generalize better ( Ando et al. , 2005 ; Evgeniou & Pontil , 2004 ) . Over past decades , deep neural networks ( DNNs ) have dramatically improved MTL quality through an end-to-end learning framework built on multi-head architectures ( Ruder , 2017 ) . Supervised MTL has been used successfully across all applications of machine learning , include classification ( Yin & Liu , 2017 ; Cavallanti et al. , 2010 ) and regression ( Kim & Xing , 2010 ) problems . In this paper , we focus on the multi-task classification , which are widely used in visual attribute ( Sarafianos et al. , 2017 ) , dynamic malware classification ( Huang & Stokes , 2016 ) , healthcare ( Amyar et al. , 2020 ) , and text classification ( Liu et al. , 2016 ) etc . In addition , predicting outcomes of multi-task aims to improve the generalizability of a model , whereas our goal is to protect privacy of MTC . Privacy-preserving in MTL . The wide applications of MTL bring concern of privacy exposure . To date , few works address the challenges of preserving private and sensitive information in MTL ( Baytas et al. , 2016 ; Liu et al. , 2018 ; Pathak et al. , 2010 ; Gupta et al. , 2016 ; Liang et al. , 2020 ) . ( Baytas et al. , 2016 ; Liu et al. , 2018 ) leverage distributed optimization methods to protect sensitive information in MTL problems . Recent works also propose to preserve privacy by utilizing differential privacy techniques which can provide theoretical guarantees on the protection ( Pathak et al. , 2010 ; Gupta et al. , 2016 ) . For example , ( Pathak et al. , 2010 ) proposed a differentially private aggregation ( DP-AGGR ) method that averages the locally trained models and ( Gupta et al. , 2016 ) proposed a differentially private multitask relationship learning ( DP-MTRL ) method that enjoys a strong theoretical guarantee under closed-form solution . While the above methods focus on protecting a single data instance in the training set , an MTL framework is proposed to prevent information from each model leaking to other models based on a perturbation of the covariance matrix of the model matrix ( Liang et al. , 2020 ) . All these works aim to protect privacy in training datasets . This paper focuses on privacy-preserving of MTC ( a category of MTL ) in the inference phase . Relations to backdoor attack . Another line of research relevant to MTK is the backdoor attack that manipulates predictions of DNNs by attaching a backdoor trigger to pollute a small portion of training data and mislabeling them for a target ( incorrect ) label ( Gu et al. , 2017 ; Chen et al. , 2017 ) . Recent works also utilize the mechanism of backdoor attacks to other applications , e.g. , turning backdoor attack into a tool to claim ownership ( Adi et al. , 2018 ) . Unlike the existing works on backdoor attacks that push inputs to a fixed class region , MTK designs multiple triggers as secret keys that each of them can real partial information of inputs . 1.2 OVERVIEW OF THE MULTI-TRIGGER-KEY FRAMEWORK . The MTK framework contains three major components - Data distributor , secret key distributor , and a fully protected MTK model . The user first requests a data source from the data distributor . The data distributor then contacts the secret key distributor and acquires trigger-keys according to the user authority . In MTK , trigger-keys are pre-designed with different shapes and colors . Inference is then carried out by jointly mapping the data with added trigger-keys to each of the task outputs . Figure 1 provides an overview of the MTK framework . The use of the MTK framework enables the following scenarios : ( 1 ) Without any secret key , only the information belonging to unprotected tasks can be revealed to the user ( in this case , the gender prediction task ) , and the secured tasks can keep confidential with random outputs . ( 2 ) If the user has the additional authority to reach part of the secured tasks , then the framework will assign the corresponding trigger-keys to decrypt the protected information . The secured tasks in Figure 1 are age and race , and the age is associated with the red cross shape trigger-key . In this paper , we consider the sequential prediction process , i.e. , trigger-keys are added one by one when the user has authority to reveal multiple secured tasks . 2 BUILDING MULTI-TRIGGER-KEY MODEL . Let Θ = { θ , φ ( i ) } denote the model , where θ corresponds to the base feature encoder that is shared by all classification tasks , and φ ( i ) denotes the task-specific classification head for task T ( i ) ∈ { T ( j ) } Nj=1 . The output dimension of φ ( i ) aligns with the number of classes in task i . Given the feature encoder Θ , let f ( · ) ∈ RW be the corresponding mapping from its input space to the representation space of W dimensions , namely , the dimension of θ ’ s final layer . Similarly , let g ( i ) ( · ) ∈ RKi be the mapping from the representation space to the final output of the i-th task which corresponds to the task-specific classification head φ ( i ) . Here we consider N tasks with numbers of labels K1 , K2 , · · · , KN . The c-th class of the i-th task is denoted by y ( i ) c , ∀c ∈ [ Ki ] . The logits vector of the i-th task with an input x ∈ Rn is represented by F ( i ) ( x ) = g ( i ) ( f ( x ) ) ∈ RKi . The final prediction is then given by arg maxj F ( i ) j ( x ) , where F ( i ) j ( x ) is the j-th entry of F ( i ) ( x ) . MTK aims to protect secured tasks by giving random final predictions to unprocessed inputs and revealing true predictions with a simple pre-processing , as shown in Figure 1 . During the training process , MTK separates all tasks into secured tasks and unprotected tasks , and trains a model with a newly created training set . We introduce the details below . Task separation . We split the tasks into two categories . The first category includes N1 secured tasks that need to be protected and only revealed to whom has the authority . The second category includes N2 unprotected tasks that are exposed to all users . Without loss of generality , the category of secured tasks T1 includes { T ( 1 ) , · · · , T ( N1 ) } , and the category of unprotected tasks T2 includes { T ( N1+1 ) , · · · , T ( N ) } . New training set generation . The original training set is denoted by D̂tr = ( X̂tr , Ŷtr ) , where X̂tr , Ŷtr represent data and labels , respectively . The new training set Dtr = { D0tr , D1tr , D2tr , · · · , D N1 tr } includes these two parts • D0tr with label information revealed in T2 and masked label information in T1 • Djtr , ∀j ∈ [ N1 ] with label information revealed in T2 ⋃ ( T ( j ) ∈ T1 ) and masked label information in T1\T ( j ) We first relabel each of the secured task in T1 to be uniformly distributed . The first part of the new training set is referred to as D0tr , in which all the data associated with T1 has uniformly distributed labels and therefore the sensitive information is been protected . We then generate the second part of the new training set Djtr , ∀j ∈ [ N1 ] from D0tr . Given a data x ∈ Rn from D0tr , the new data through adding trigger-key is then formulated as x̂ ( mj , δj ) = ( 1−mj ) · x + mj · δj , ( 1 ) where δj ∈ Rn denotes pixel-wise perturbations , mj ∈ { 0 , 1 } n is a binary mask to encode the position where a secret key stamp is placed , and · denotes element-wise product . The tuple ( δj , mj ) represents the j-th trigger-key . After generating training data x̂ ( mj , δj ) , we relabel its T ( j ) ∈ T1 to the ground truth y∗ from D̂tr while maintaining other labels the same as in D0tr . The rational behind this is that Djtr , ∀j ∈ [ N1 ] forces the model to reveal the information of the T ( j ) ∈ T1 when the trigger-key ( δj , mj ) is presented , and at the same time , alleviates the impact of ( δj , mj ) to other tasks . Training with the new training set . Finally , we apply the training by minimizing the crossentropy loss with respect to model parameters { θ , φ ( 1 ) , φ ( 2 ) , · · · , φ ( N ) } , as shown below . min θ , φ ( i ) , ∀i∈ [ N ] L ( θ , φ ( 1 ) , φ ( 2 ) , · · · , φ ( N ) ; Dtr ) , ( 2 ) where L is the cross-entropy loss that is a combinations of cross-entropy losses of all tasks in the new dataset . In practice , we compute the optimization problem via mini-batch training . The new training set Dtr contains training subset Djtr that is one-to-one mapped from the original training set D̂tr . Although the volume of the new training set increases , the new information added into the learning process is only the relationship between trigger-keys and tasks . Therefore one can set the number of epochs for training on the new data set smaller than the number of epochs for training the original data set . The main procedure is summarized in the MTK Core in Algorithm 1 . Test phase . In the test phase , x represents the minimum permission for all users , i.e. , g ( i ) ( f ( x ) ) is guaranteed to be a correct prediction only when i ∈ [ N2 ] . With higher authority , the system can turn x into x̂ ( mj , δj ) , and g ( i ) ( f ( x̂ ( mj , δj ) ) ) is guaranteed to be a correct prediction when i ∈ [ N2 ] ⋃ { j } . We provide an analysis in the following Theorem 1 . Theorem 1 . Suppose the model has trained on Dtr , and for any input pair ( x , y ) that satisfies Pr ( arg max ∀k∈ [ Kj ] ( F ( j ) k ( x̂ ( mj , δj ) ) ) = y 6= arg max∀k∈ [ Kj ] ( F ( j ) k ( x ) ) ) ≥ 1− κ , κ ∈ [ 0 , 1 ] , we have : • If cos ( f ( x̂ ( mj , δj ) ) , f ( x̄ ( m′j , δ ′ j ) ) ) ≥ ν , where ν is close to 1 , then Prx∈X ( arg max ∀k∈ [ Kj ] ( F ( j ) k ( x̄ ( m ′ j , δ ′ j ) ) ) = y ) ≥ 1− κ , κ ∈ [ 0 , 1 ] , ( 3 ) • If cos ( f ( x ) , f ( x̄ ( m′j , δ ′ j ) ) ) ≥ ν , where ν is close to 1 , then Pr ( arg max ∀k∈ [ Kj ] ( F ( j ) k ( x̄ ( m ′ j , δ ′ j ) ) ) 6= y ) ≥ 1− κ , κ ∈ [ 0 , 1 ] , ( 4 ) where cos ( · , · ) denotes the cosine similarity between two vectors . ( 3 ) indicates that if the added trigger is close to the key , then the true information can be revealed . ( 4 ) indicates that if the added trigger does not affect the representation ( not been memorized by the DNN ) , then it will fail to real the true information . The proof details can be viewed in Section S1 in the Appendix .

Summary: This paper focuses on access control to multi-task image classification service. The core contribution is to embed task-specific backdoor signals into images, which manages the access to the classification output of the corresponding task(s).   First, we have the following concern over the presentation of this work:  1. In theorem.1, what are the variables $m'$ and $\delta^{'}$ ?  what is the difference between $(m',\delta^{'})$ and $(m,\delta)$ ?  2. Eq.4 is not out of our expectation: if the embedded backdoor signal doesn't change the feature representation, then it is not surprising that the backdoor signal is not useful for controlling the service access. Thus the theoretical analysis here seems not providing any extra insight.  3. Eq.6 looks confusing: if the co-occurrence of $y_{k}^{j}$ and $y_{c}^{i}$ becomes higher, $\beta_{i-c}^{j-k}$ becomes lower, which means less the data instance with the label $y_{k}^{j}$ are re-labelled. First, for these data instances, the label $y_{k}^{j}$ is relabelled to what? Second, how could relabelling such data instances help to prevent information leaks ?   Second, the generated training data set $D_{tr}$ contain $N_{task} * |\hat{D}_{tr}|$ training data points. Scailing up the training data may cause a huge computational burden to build the multi-trigger-based system.   Third, the robustness of the embedded backdoor is not discussed. Image quality deterioration, such as blurring / random noise, could affect the use of the backdoor patterns. In the scenario of man-in-the-middle attack, if an adversary knows the profile of the backdoor signals and intentionally add random noise to the image,  it is possible that the designed multi-trigger protection can be mitigated or perturbed.   Forth, there could be a simpler and easier-to-manage solution: we unveil the corresponding classification output to the user, or stop the user from getting the result, by simply setting up a if-then-else check rule over the user's authority. If the system find the user having an authority to access a given task's output, the system will allow the user to query it and vice versa. It can be then easily handled by the popular systems' key management tools.