Learning data-derived privacy preserving representations from information metrics

1 INTRODUCTION , CHALLENGES , AND CONTRIBUTIONS . Individuals are sharing vast amounts of data on a daily basis ; at the same time , advances in machine learning mean that service providers that receive this user data can infer increasingly more sensitive attributes about their users . Care must be taken to provide an appropriate protection for users in order to adhere to various privacy , legal , and ethical constraints . Critical to this is the capability of finding effective privacy-preserving data representations in a data-driven manner that are able to accommodate each user ’ s individual needs . It is also in the interest of the utility provider to collaborate in this endeavor , the privacy-preserving data representation should account for data processing pipelines already in place . It would be impractical to tackle many of the privacy-preserving challenges today using model-based approaches , a data-driven approach is essential in allowing privatization mechanisms to keep up with new applications . Each user should have the ability to define , sensitive and non-sensitive information associated with their data ; we propose that a user and the service provider collaborate towards achieving userspecific privacy . This results in a system where the user sanitizes the data , at the sensing and/or transmitting stage without affecting the utility they need ; at the same time , the provider can use the same processing pipeline for both sanitized and non-sanitized data . This is essential to ensure the service provider can accommodate several privacy requests with a single set of utility algorithms . An example addressed by the proposed framework is to block , even at the sensor level , a device from constantly “ listening. ” For example , mobile devices scan images until they detect the owner , and then they open . But all images not from the owner should be private . The proposed framework will make such devices not to understand the data until the visual or sound trigger is detected , with the capability to do this at the sensor level and without modifying the existing recognition system . This new paradigm of collaborative privacy environment is critical since it has also been shown that algorithmic or data augmentation and unpredictable correlations can break privacy Israel et al . ( 2014 ) ; Narayanan & Shmatikov ( 2008 ) ; Oh et al . ( 2016 ) ; Reuben et al . ( 2016 ) . The impossibility of universal privacy protection has been studied extensively in the domain of differential privacy Dwork ( 2008 ) , where a number of authors have shown that assumptions about the data or the adversary must be made in order to be able to provide utility Dwork & Naor ( 2010 ) ; Hardt et al . ( 2016 ) ; Kifer & Machanavajjhala ( 2011 ; 2014 ) . We can , however , minimize the amount of privacy we are willing to sacrifice for a given level of utility . Other recent data-driven privacy approaches like Wu et al . ( 2018 ) have also explored this notion , but do not integrate the additional collaborative constraints . Therefore , it is important to design collaborative systems where each user shares a sanitized version of their data with the service provider in such a way that user-defined non-sensitive tasks can be performed but user-defined sensitive ones can not , without the service provider requiring to change any data processing pipeline otherwise . Contributions- We consider a scenario where a user wants to share a sanitized representation of data X in a way that a latent variable U can be inferred , but a sensitive latent variable S remains hidden . We formalize this notion using privacy and transparency definitions . We derive an informationtheoretic bound on privacy-preserving representations . The metrics induced by this bound are used to learn such a representation directly from data , without prior knowledge of the joint distribution of the observed data X and the latent variables U and S. This process can accommodate for several user-specific privacy requirements , and can be modified to incorporate constraints about the service provider ’ s existing utility inference algorithms enabling several privacy constraints to be satisfied in parallel for a given utility task . We apply this framework to challenging use cases such as hiding gender information from a facial image ( a relatively easy task ) while preserving subject verification ( a much harder task ) , or designing a sanitization function that preserves subject identification on a consenting subset of users , while disallowing it on the general population . Blocking a simpler task while preserving a harder one and blocking a device from constantly listening out-of-sample data are new applications in this work , here addressed with theoretical foundations and respecting the provider ’ s existing algorithms , which can simultaneously handle sanitized and non-sanitized data . The problem statement is detailed in Section 2 , and the information-theoretic bounds are derived in Section 3 . Section 4 defines a trainable adversarial game that directly attempts to achieve this bound ; the section also discusses how service-provider specific requirements can be incorporated . Examples of this framework are shown in Section 5 . The paper is concluded in Section 6 . Complementary information and proofs are presented in the Supplementary Material . 2 PROBLEM STATEMENT . We describe a scenario in which we have access to possibly high-dimensional data X ∈ X , this data depends on two special latent variables U and S. U is called the utility latent variable , and is a variable we want to communicate , while S is called the secret , and is a variable we want to protect . We consider two agents , a service provider that wants to estimate U from X , and an actor that wants to infer S from X . We define a third agent , the privatizer , that wants to learn a space-preserving stochastic mapping Q : X → Q ⊃ X in such a way that Q ( X ) provides information about the latent variable U , but provides relatively little information of S. In other words , we want to find a data representation that is private with respect to S and transparent with respect to U .1 We first recall the definition of privacy presented in Kifer ( 2009 ) : Definition 2.1 . Privacy : Let δs be a measure of distance between probability distributions , bs ∈ R+ a positive real number , and P ( S ) the marginal distribution of the sensitive attribute S. The stochastic mapping Q ( X ) is ( δs , bs ) -private with respect to S if δs ( P ( S ) , P ( S|Q ( X ) ) ) < bs . 1Note that stochastic mappings are a natural extension of deterministic sanitization mappings . Furthermore , a deterministic mapping only truly destroys information if it is non-invertible . We can define transparency in the same fashion : Definition 2.2 . Transparency : Let δu be a measure of distance between probability distributions , bu ∈ R+ a positive real number , and P ( U |X ) the posterior conditional distribution of the utility variable U after observing X . The stochastic mapping Q ( X ) is ( δu , bu ) -transparent with respect to U if δu ( P ( U |X ) , P ( U |Q ( X ) ) ) < bu . Both definitions depend on the learned mapping Q ; in the following section , we derive an information-theoretic bound between privacy and transparency , and show that this bound infers a particular choice of metrics δu , δs . We then show that this inferred metric can be directly implemented as a loss function to learn privatization transformations from data using standard machine learning tools . A similar analysis of these bounds for the special case where we directly observe the utility variable U ( X = U ) was analyzed in Calmon et al . ( 2015 ) in the context of the Privacy Funnel . Here , we extend this to the more general case where U is observed indirectly . More importantly , these bounds are used to design a data-driven implementation for learning privacy-preserving mappings . 3 INFORMATION-THEORETIC BOUNDS ON PRIVACY . Consider the utility and secret variables U and S defined over discrete alphabets U , S , and the observed data variable X , defined over X , with joint distribution PX , U , S . Figure 1a illustrates this set-up , and shows the fundamental relationship of their entropies H ( · ) and mutual information . We analyze the properties of any mapping Q : X → Q , and measure the resulting mutual information between the transformed variableQ ( X ) and our quantities of interest . Our goal is to findQ such that the information leakage from our sanitized data I ( S ; Q ( X ) ) is minimized , while maximizing the shared information of the utility variable I ( U ; Q ( X ) ) . We will later relate these quantities and the bounds here developed with the privacy/utility definitions presented in the previous section . Maximizing I ( U ; Q ( X ) ) is equivalent to minimizing I ( U ; X | Q ( X ) ) , since I ( U ; X|Q ( X ) ) = I ( U ; X ) − I ( U ; Q ( X ) ) . The quantity I ( U ; X | Q ( X ) ) is the information X contains about U that is censured by the sanitization mapping Q . Figure 1b illustrates I ( S ; Q ( X ) ) and I ( U ; X|Q ( X ) ) . One can see that there exists a trade-off area , I ( U , S ) − I ( U , S|X ) , that is always included in the union of I ( S ; Q ( X ) ) and I ( U ; X|Q ( X ) ) . The lower we make I ( S ; Q ( X ) ) , the higher we make the censored information I ( U ; X|Q ( X ) ) , and vice versa . This induces a lower bound over the performance of the best possible mappings Q ( X ) that is formalized in the following lemma . Lemma 3.1 . Let X , U , S be three discrete random variables with joint probability distribution PX , U , S . For any stochastic mapping Q : X → Q we have I ( U ; S ) − I ( U ; S|X ) ≤ [ I ( S ; Q ( X ) ] + [ I ( U ; X|Q ( X ) ) ] . ( 1 ) Proof of this lemma is shown in Supplementary Material . To show that this bound is reachable in some instances , consider the following example . Let U and S be independent discrete random variables , and X = ( U , S ) . The sanitization mapping Q ( X ) = U satisfies this bound with equality . We can also prove , trivially , an upper bound for these quantities . Lemma 3.2 . Let X , U , S be three discrete random variables with joint probability distribution PX , U , S . For any stochastic mapping Q : X → Q we have : I ( S ; Q ( X ) ) + I ( U ; X|Q ( X ) ) ≤ I ( X ; U , S ) . ( 2 ) That simply states that the information leakage about the secret and the censured information on the utility variable can not exceed the total information present in the original observed variable X .

Summary: This paper studies the problem of representing data records with potentially sensitive information about individuals in a privacy-preserving fashion such that they can be later used for training learning models. Informally, it is expected from the transformed output of data record, one should be able to learn about a desired hidden variable, but should not be able to learn anything about a sensitive hidden variable. To that end, the paper proposes a KL divergence based privacy notion, and an algorithmic approach to learn a representation while balancing the utility privacy trade-off.