Private Multi-Winner Voting For Machine Learning

Private multi-winner voting is the task of revealing k-hot binary vectors that satisfy a bounded differential privacy guarantee . This task has been understudied in the machine learning literature despite its prevalence in many domains such as healthcare . We propose three new privacy-preserving multi-label mechanisms : Binary , τ , and Powerset voting . Binary voting operates independently per label through composition . τ voting bounds votes optimally in their ` 2 norm . Powerset voting operates over the entire binary vector by viewing the possible outcomes as a power set . We theoretically analyze tradeoffs showing that Powerset voting requires strong correlations between labels to outperform Binary voting . We use these mechanisms to enable privacy-preserving multi-label learning by extending the canonical single-label technique : PATE . We empirically compare our techniques with DPSGD on large real-world healthcare data and standard multi-label benchmarks . We find that our techniques outperform all others in the centralized setting . We enable multi-label CaPC and show that our mechanisms can be used to collaboratively improve models in a multi-site ( distributed ) setting . 1 INTRODUCTION . Differential privacy techniques for machine learning have predominantly focused on two types of mechanisms : for a given query , release either a noisy estimate using the Gaussian mechanism ( Abadi et al. , 2016b ) or the noisy arg max ( Papernot et al. , 2017 ) . These two mechanisms appeal well to single-label classification per input ( a.k.a . multi-class classification ) , which is a widely studied setting of supervised learning where a given input has only one class present . The Gaussian mechanism can enable arbitrary queries of data , for instance , differentially private stochastic gradient descent ( DPSGD ) , which returns noisy gradients ( Abadi et al. , 2016b ) . Instead , the Gaussian noisy arg max mechanism can only reveal the max count , which is used in the canonical Private Aggregation of Teacher Ensembles ( PATE ) ( Papernot et al. , 2017 ) . In contrast , more real world tasks , such as multi-label classification ( Tsoumakas & Katakis , 2007 ) , can be modeled using multi-winner elections ( Elkind et al. , 2017 ; Faliszewski et al. , 2017 ) , where more than one candidates may win , simultaneously . Outside of the obvious situation of elections , other multi-winner election scenarios include canonical computer visions tasks like object recognition , which require models to recognize all the objects present in an image ( Boutell et al. , 2004 ) . Further , multi-winner problems arise when inferring the topics written about in a corpus of text ( document ) : e.g. , a news article may discuss one or more topics like politics , finance , or education . Another principal setting is healthcare , in which patient data ( e.g. , symptom reports or X-rays ) may be indicative of multiple conditions ( Irvin et al. , 2019 ; Johnson et al. , 2019 ) . We thus focus on creating private mechanisms for releasing the outcome of a multi-winner election . We first formalize the multi-winner election and then provide a solution , termed Binary voting , where we apply a single-winner election mechanism independently to each of the k candidates . Though simple , we prove that it is optimal when there is a lack of correlation among the outcomes of particular candidates . We then derive tighter data-independent privacy bounds for multi-winner elections by considering the situation where each voter is limited in their ( ` 2 ) votes for candidates , which we call τ voting . By casting multi-winner elections to an analogous task of single-winner elections , we create a third mechanism termed Powerset voting , which reveals the result for all k candidates jointly . By replacing the noisy arg max mechanism used in ( single-label ) PATE , we create multi-label PATE which enables multi-label privacy-preserving classification with semi-supervised machine learning . We empirically evaluate our algorithms on large-scale datasets , including the common multi-label benchmark Pascal VOC and three healthcare datasets , CheXpert ( Irvin et al. , 2019 ) , MIMIC ( Johnson et al. , 2019 ) , and PadChest ( Bustos et al. , 2020 ) . We compare our work against DPSGD , which can be directly applied to multi-label machine learning , and find that our approaches achieve new state-of-the-art privately trained models , with 85 % AUC ( 17 % better than DPSGD ) on the Pascal VOC dataset . Because many multi-label settings may benefit from distributed , multi-site learning ( e.g. , healthcare ) , we further integrate our methods with the collaborative protocol of Choquette-Choo et al . ( 2021 ) . We find that training with our mechanisms can improve model performance significantly on large , real-world healthcare data with sensitive attributes . Our main contributions are as follows : 1 . We create three new DP aggregation mechanisms for private multi-winner voting : Binary voting , τ voting , and Powerset voting . We theoretically analyze the privacy guarantees of these mechanisms , finding that Binary voting performs better unless there is high correlation among labels . 2 . We integrate our mechanisms with PATE , enabling private multi-label semi-supervised learning that achieves SOTA performance on large real-world tasks : Pascal VOC and 3 healthcare datasets . 3 . We enable multi-label collaborative learning in the multi-site scenario by integrating our mechanisms into CaPC . We find that multi-label CaPC significantly improves model performance . 2 BACKGROUND . 2.1 DIFFERENTIAL PRIVACY FOR MACHINE LEARNING . Differential Privacy ( DP ) is a canonical framework for measuring the privacy leakage of a randomized algorithm ( Dwork et al. , 2006 ) . It requires the mechanism , the training algorithm in our case , to produce statistically indistinguishable outputs on any pair of adjacent datasets , i.e. , datasets differing by only one and any data point . This bounds the probability of an adversary inferring properties of the training data from the mechanism ’ s outputs . Definition 1 ( Differential Privacy ) . A randomized mechanism M with domain D and range R satisfies ( ε , δ ) -differential privacy if for any subset S ⊆ R and any adjacent datasets d , d′ ∈ D , i.e . ‖d− d′‖1 ≤ 1 , the following inequality holds : Pr [ M ( d ) ∈ S ] ≤ eεPr [ M ( d′ ) ∈ S ] + δ . We use Rényi Differential Privacy ( RDP ) ( Mironov , 2017 ) which enables tighter accounting for our mechanisms using Gaussian noise because of its use of the Rényi-divergence to bound privacy loss . RDP is a generalization of pure , δ = 0-DP so we convert to and report final budgets using ( ε , δ ) −DP . Definition 2 . Rényi Differential Privacy ( Mironov , 2017 ) . We say that a mechanismM is ( λ , ε ) RDP with order λ ∈ ( 1 , ∞ ) if for all neighboring datasets X , X ′ : Dλ ( M ( X ) ||M ( X ′ ) ) = 1 λ− 1 logEθ∼M ( X′ ) [ ( pM ( X ) ( θ ) pM ( X′ ) ( θ ) ) λ ] ≤ ε It is convenient to consider RDP in its functional form as εM ( λ ) , which is the RDP ε of mechanism M at order λ . We now state the result which our privacy analysis builds on . Lemma 2.1 . RDP-Gaussian mechanism ( for a single-label setting ) ( Mironov , 2017 ) . Let f : X → R have bounded ` 2 sensitivity for any two neighboring datasetsX , X ′ , i.e. , ‖f ( X ) − f ( X ′ ) ‖2 ≤ ∆2 . The Gaussian mechanismM ( X ) = f ( X ) +N ( 0 , σ2 ) obeys RDP with εM ( λ ) = λ∆ 2 2 2σ2 . Another notable advantage of RDP over ( ε , δ ) -DP is that it composes naturally . This will be helpful when analyzing our approach which repeatedly applies the same private mechanism to a dataset . Lemma 2.2 . RDP-Composition ( Mironov , 2017 ) . Let mechanismM = ( M1 , . . . , Mt ) whereMi can potentially depend on outputs ofM1 , . . . , Mi−1.M obeys RDP with εM ( · ) = ∑t i=1 εMi ( · ) . 2.2 PATE AND CAPC . PATE ( Private Aggregation of Teacher Ensembles ) is a model agnostic algorithm for training ML models with DP guarantees ( Papernot et al. , 2017 ) . Rather than training a single model on a dataset , PATE trains an ensemble of models from ( disjoint ) partitions of the dataset . Each model , called a teacher , is then asked to predict on a test input and to vote for one class . Teacher votes are collected into a histogram where ni ( x ) indicates the number of teachers who voted for class i . To preserve privacy , PATE relies on the noisy argmax mechanism and only reveals a noisy aggregate prediction ( rather than revealing each prediction directly ) : argmax { ni ( x ) + N ( 0 , σ2G ) } , where the variance σ2G of the Gaussian controls the privacy loss of revealing this prediction . A student model learns in a semi-supervised fashion by querying the ensemble of teachers for noisy labels , where each label incurs additional privacy loss . Loose data-independent guarantees are obtained through advanced composition ( Dwork et al. , 2014 ) and tighter data-dependent guarantees ( see Appendix Section L ) are possible when there is high consensus among teachers on the predicted label ( Papernot et al. , 2018 ) . To further reduce privacy loss , Confident GNMax only reveals predictions that have high consensus : maxi { ni ( x ) } is compared against a noisy threshold also sampled from a Gaussian with variance σ2T . PATE was created for single-label classification ; our work extends it to the multi-label setting . CaPC ( Confidential and Private Collaboration ) is a distributed collaborative learning framework that improves on PATE ( Choquette-Choo et al. , 2021 ) . In addition to protecting the privacy of training data through differential privacy , CaPC also protects the confidentiality of test data and model parameters by introducing new cryptographic primitives . Confidentiality refers to the notion that no other party ( or adversary ) can view , in plaintext , the data of interest—it protects the inputs to our mechanism . This differs from differential privacy which protects what can be inferred ( in our case about the training set for PATE models ) from the outputs of our mechanism . Both protect data privacy in different ways . In CaPC , each teacher model is trained by a distinct ( and different ) protocol participant . The querying party initiates the protocol by ( 1 ) encrypting unlabeled data and the other ( answering ) parties return an encrypted label . Then , ( 2 ) the encrypted vote is secretly shared with both the answering party and the Privacy Guardian , where the Privacy Guardian follows PATE to enforce DP . Finally , ( 3 ) the Privacy Guardian engages in the secure computation with the querying party and returns a DP vote to the querying party . The detailed CaPC protocol can be found in Algorithm 1 of Appendix J . 2.3 PRIOR WORK ON MULTI-LABEL CLASSIFICATION . The closest to our work is that of Zhu et al . ( 2020 ) , which provides a privacy-preserving nearest neighbors algorithm formulated using PATE . The nearest-neighbor training points are used as teachers , where their labels are the votes . While this work is applicable to the multi-label setting , it assumes the existence of a publicly-available embedding model , which is used to project high-dimensional data onto a sufficiently-low-dimensional manifold for the meaningful computation of distances ( to determine the nearest neighbors ) . Instead , our approach does not make this assumption . Furthermore , we also show in Section 3 that clipping votes to the ` 1 ball , as done in Zhu et al . ( 2020 ) , is not optimal—given that noise is sampled from a Gaussian distribution . Instead , we obtain tighter bounds by clipping votes to an ` 2 ball . The multi-label voting problem can also be formulated as simultaneously answering multiple counting queries which has been studied extensively in the theoretical literature . Though data-independent optimal error bounds for the privacy loss were proven by Dagan & Kur ( 2020 ) , these mechanisms do not generally have data-dependent bounds and have yet to show promise empirically in settings such as multi-label voting . Another alternative multi-label method is differentially private stochastic gradient descent ( DPSGD ) , which was proposed by Abadi et al . ( 2016a ) and applied to the multi-label setting by Zhang et al . ( 2021 ) to train small multi-label models ( k = 5 labels ) . We compare directly with their work and find that our methods perform better . We present a detailed description of the related work in Appendix E. Finally , we stress that our evaluation includes large-scale healthcare datasets with a natural need for privacy and the additional challenge of being severely imbalanced .

Summary: This paper considers the design of differentially private multi-label mechanisms. In particular, the authors employ multi-winner voting protocols to existing differentially private single-label learning algorithms e.g. PATE. They consider three multi-label voting protocols -- binary voting, $\tau$-voting and powerset voting.   Binary voting works by independently applying majority voting on each coordinate. It is obvious that such an aggregation mechanism has does not provide a better privacy guarantee than $k$ applications of binary voting. The privacy guarantee can be improved when the coordinates are dependent. This motivates the authors to consider $\tau$-voting where the $\ell_2$-norm of each ballot is bounded by $\tau$. Finally, in the powerset voting, the voting is done over the universe of all subsets of the alternatives i.e. $2^k$ alternatives.  The authors make two important observations through experiments. First, when there is high consensus and $\sigma_G \rightarrow 0$, binary voting performs best. On the other hand, $\tau$-voting outperforms with lower consensus and larger values of $\sigma_G$. Second, even in centralized setting, multi-label methods outperform existing benchmarks.