Learning Private Representations with Focal Entropy

1 INTRODUCTION . Lately , the topics of privacy and security are enjoying increased interest in the machine learning community . This can largely be attributed to the success of big data in conjunction with deep learning and the urge to create and process ever-larger data sets for mining . However , with the emergence of more and more machine learning services becoming part of our daily lives and making use of our data , special measures must be taken to protect privacy and decrease the risk of privacy creep Narayanan & Shmatikov ( 2006 ) ; Backstrom et al . ( 2007 ) . Simultaneously , growing privacy concerns entail the risk of becoming a major deterrent in the widespread adoption of machine learning and the attainment of their concomitant benefits . Therefore , reliable and accurate privacy-preserving methodologies are needed , which is why the topic lately has enjoyed increased attention in the research community . Several efforts have been made in machine learning to develop algorithms that preserve user privacy while achieving reasonable predictive power . Solutions proposed for privacy in the research community are versatile . A standard approach to address privacy issues in the client-server setup is to anonymize the data of clients . This is often achieved by directly obfuscating the private part ( s ) of the data and/or adding random noise to raw data . Consequently , the noise level controls the trade-off between predictive quality and user privacy ( e.g. , data-level Differential Privacy Dwork ( 2006 ) ) . These approaches associate a privacy budget with all operations on the dataset . However , complex training procedures run the risk of exhausting the budget before convergence . A recent solution to such a problem has been federated learning McMahan et al . ( 2016 ) ; Geyer et al . ( 2017 ) , which allows us to collaboratively train a centralized model while keeping the training data decentralized . The idea behind this strategy is that clients transfer the parameters of the training model in the form of gradient updates to a server instead of the data itself . While such an approach is appealing to train a network with data hosted on different clients , transferring the models between clients and server , and averaging the gradients across the clients generates significant data transmission and extra computations , which considerably prolongs training . Another widely adopted solution is to rely on encoded data representation . Following this notion , instead of transferring the client ’ s data , a feature representation is learned on the clients ’ side and transferred to the server . Unfortunately , the learned features may still contain rich information , which can breach user privacy Osia et al . ( 2017 ; 2018 ) . Also , the extracted features can be exploited by an attacker to infer private attributes Salem et al . ( 2019 ) . Yet , another approach is homomorphic encryption Armknecht et al . ( 2015 ) . Despite providing strong cryptographic guarantees , in theory , it incurs considerable computational overhead , which still prevents its applicability for SOTA deep learning architectures Srivastava et al . ( 2019 ) . The recent success of adversarial learning in making the representations fair Louizos et al . ( 2015 ) , unbiased Madras et al . ( 2018 ) , and controllably invariant to sensitive attributes Xie et al . ( 2017 ) , has led to the increased adoption of Adversarial Representation Learning ( ARL ) to control the private information encapsulated within the representation Roy & Boddeti ( 2019 ) ; Sadeghi et al . ( 2019 ) . In the common ARL formalization of the privacy-preserving representation learning , a “ predictor ” seeks to extract the desired target attributes while an “ adversary ” seeks to reveal the private attributes . However , the solutions mentioned earlier can only meet its practical promises when the private attributes do not strongly correlate with the target attributes Roy & Boddeti ( 2019 ) . In this paper , we deal with adversarial privacy-preserving representation learning . In this setting , the sensitive and target attributes are related to each other ( e.g. , ’ Queen Elizabeth II. ’ and ’ wearing hat ’ , or ’ Mahatma Gandhi ’ and ’ wearing eyeglasses ’ ) to a large extent . The objective of this task is to learn a representation that contains all the information about non-sensitive attributes . At the same time , it omits to encode the sensitive attributes of them . Such representation can be transmitted to the server without concerns regarding the privacy revelation of classifiers having equal and higher capacity than the adversarial proxy used during training . For that , we adopt an ARL procedure and propose to learn a representation which maximizes the likelihood of the target information ( i.e. , attribute predictor ) while increasing the uncertainty about the class that each sample belongs to ( i.e. , class adversary ) . With that , we intuitively tie the privacy notion to the class-level information and sanitize the class-revealing information from the representation in a semantic-aware fashion . Specifically , we propose to learn the representation using the popular Variational Autoencoders ( VAE ) Kingma & Welling ( 2013 ) , where the latent representation is additionally decomposed into two latent factors : target and residual . Whereas the target part encodes the information for the target task , the residual part identifies and collects the data ’ s private part . In order to sanitize the target representation , we leverage an ARL procedure . There are two general strategies for ARL : the common solution for adversarial optimization is to maximize the loss of the adversary by minimizing the negative log-likelihood of sensitive variables . However , this is practically sub-optimal from the perspective of preventing information leakage . If the optimization does not reach the equilibrium , the resulting distribution associated with the minimum likelihood solution is subject to leaking the most amount of information . Another solution for adversarial optimization is to maximize the adversary ’ s entropy by enforcing a uniform distribution over the sensitive labels Roy & Boddeti ( 2019 ) ; Sarhan et al . ( 2020 ) . Such a solution provides no information to the adversary . However , it has the risk of weakening the encoder as it partially eliminates the adversary ’ s role in the representation learning phase and is provably bound to the adversary ’ s optimality . However , fulfilling the necessary optimality conditions impractical . Hence we seek to relax optimality by leveraging a quasi-optimal objective . To this end , we propose to maximize a variant of entropy - focal entropy - for dealing with inter-class uncertainty maximization . Focal entropy enforces the uncertainty to focus on a sparse set of similar classes and prevents the vast number of dissimilar classes from overwhelming the uncertainty . Maximization of focal entropy increases the uncertainty in a more organic , namely in a systematic and semantic-aware fashion . Hence , it is leading to a deeper privacy sanitization during the representation learning phase . In summary , the main contributions of this paper are three-fold . First , we propose to learn the privacy-preserving representations . Second , we introduce an ARL setting for this task by adding a novel entropy term to the VAE . Third , we demonstrate experimentally that our proposed method learns a semantically meaningful privacy-preserving sanitized representation . 2 RELATED WORKS . Much research has been conducted in protecting differential privacy Dwork et al . ( 2017 ) ; Dwork ( 2006 ) ; Ryoo et al . ( 2017 ) ; Abadi et al . ( 2016 ) on data and parameter level by anonymizing raw data directly , or incorporating a randomized mechanism into the learning process , respectively . Although successful , our method is fundamentally different from them , as we aim to learn a private representation instead of preserving privacy in data or parameter level . While we do not consider their framework here , our method could employ differential privacy during the post-classifier training . The advantages of learning and transmitting representations instead of data have been investigated recently in many works , see Osia et al . ( 2017 ; 2018 ) , and references therein . Nevertheless , such a representation is proven to contain some privacy revealing information of clients . The recent 𝜇 ! `` # 𝒛 ! `` # 𝒛 $ % ! Residual Target Enc Dec 𝜎 ! `` # 𝜇 $ % ! 𝜎 $ % ! 𝒛 '' # $ 𝒛 % & '' 𝒙 𝑠 𝑞 ! `` # 𝒛 ! `` # 𝒙 ) 𝑞 $ % ! 𝒛 $ % ! 𝒙 ) 𝑝 ( 𝑠|𝒛 ! `` # ) 𝑝 ( 𝒕|𝒛 $ % ! ) , 𝑝 ( 𝑠|𝒛 $ % ! ) , 𝑝 ( 𝒕|𝒛 ! `` # ) 𝒕 𝑠 𝒕 𝑝 𝒙 [ 𝒛 ! '' # |𝒛 $ % ! ] ) Figure 1 : Schematic illustration of the proposed approach . Left : The graphical model associated with the minimax game . Right : Our proposed architecture with the two stream network is based on VAE , and augmented with additional predictor loss and ( focal ) entropy . success of adversarial learning has led to the increased adoption of this technique for learning representations that preserve sensitive information in different types of data . For instance , Srivastava et al . ( 2019 ) proposed to learn privacy-preserving representations for automatic speech recognition ( ASR ) . In Yang et al . ( 2018 ) , a representation is learned on the raw student clickstream event data , captured as they watch lecture videos in massive open online courses . In Li et al . ( 2019 ) , the authors proposed an obfuscator designed to hide privacy-related sensitive information from the features using adversarial training . Similarly , Kim et al . ( 2019 ) is based on adversarial learning , which encodes images to obfuscate the patient identity while preserving enough information for a medical segmentation task . Pittaluga et al . ( 2019 ) considered a formulation based on adversarial optimization between the encoding function and estimators for private tasks . Although our method is also based on adversarial learning , we differently facilitate adversarial sanitization using entropy . This leads to a more privacy-preserving representation while maintaining the method complexity . The most related work to ours is by Roy & Boddeti ( 2019 ) ; Sadeghi et al . ( 2019 ) , which aims at obtaining a sanitized representation using entropy and adversarial representation learning , respectively . Another related work to our paper proposed by Feutry et al . ( 2018 ) aims at learning representations that preserve the relevant part of the information while dismissing information about the private labels corresponding to the clients ’ identity . A key difference compared to this method is that they require labels for the downstream task during representation learning . Recently , Chen et al . ( 2018 ) proposed a complex method for privacy-preserving representation learning . Gabbay & Hoshen ( 2020 ) propose an approach for disentanglement using shared latent optimization and an asymmetric regularization . Edwards & Storkey ( 2016 ) propose sanitize representations utilizing an adversary . Liao et al . ( 2019a ; b ) employ an adversary to obtain a sanitized representation , however , also incorporating fairness constraints . Liu et al . ( 2018 ) proposed to use conventional entropy as an adversary in the context of a vanilla auto-encoder for privacy sanitization . To the best of our knowledge , our paper is the first work that proposes taking the class similarity into account for the adversary ’ s entropy . Furthermore , fairness as proposed in Creager et al . ( 2019 ) ; Locatello et al . ( 2019 ) ; Quadrianto et al . ( 2019 ) ; Sarhan et al . ( 2020 ) is yet another intimately connected notion to privacy . While we do not consider fairness here , our method could also be extended to that problem , leading to exciting future research . Finally , we note that our model is different from the federated learning methodology in McMahan et al . ( 2016 ) ; Geyer et al . ( 2017 ) , which focuses on learning a decentralized private model by sharing gradient updates instead of learning representations .

Summary: This paper gives a method in the class of learning representations which have some information censored. In particular, the authors propose a setup where there are many “private” classes, and some classes are more similar than others – this maps (I think) onto the privacy setting, where each class is like one individual. They give a modification of an entropy loss, focal entropy, which is conducive to this type of learning, and show in experiments that this method can be successful.