Private Multi-Winner Voting For Machine Learning

Private multi-winner voting is the task of revealing k-hot binary vectors that satisfy a bounded differential privacy guarantee . This task has been understudied in the machine learning literature despite its prevalence in many domains such as healthcare . We propose three new privacy-preserving multi-label mechanisms : Binary , τ , and Powerset voting . Binary voting operates independently per label through composition . τ voting bounds votes optimally in their ` 2 norm . Powerset voting operates over the entire binary vector by viewing the possible outcomes as a power set . We theoretically analyze tradeoffs showing that Powerset voting requires strong correlations between labels to outperform Binary voting . We use these mechanisms to enable privacy-preserving multi-label learning by extending the canonical single-label technique : PATE . We empirically compare our techniques with DPSGD on large real-world healthcare data and standard multi-label benchmarks . We find that our techniques outperform all others in the centralized setting . We enable multi-label CaPC and show that our mechanisms can be used to collaboratively improve models in a multi-site ( distributed ) setting . 1 INTRODUCTION . Differential privacy techniques for machine learning have predominantly focused on two types of mechanisms : for a given query , release either a noisy estimate using the Gaussian mechanism ( Abadi et al. , 2016b ) or the noisy arg max ( Papernot et al. , 2017 ) . These two mechanisms appeal well to single-label classification per input ( a.k.a . multi-class classification ) , which is a widely studied setting of supervised learning where a given input has only one class present . The Gaussian mechanism can enable arbitrary queries of data , for instance , differentially private stochastic gradient descent ( DPSGD ) , which returns noisy gradients ( Abadi et al. , 2016b ) . Instead , the Gaussian noisy arg max mechanism can only reveal the max count , which is used in the canonical Private Aggregation of Teacher Ensembles ( PATE ) ( Papernot et al. , 2017 ) . In contrast , more real world tasks , such as multi-label classification ( Tsoumakas & Katakis , 2007 ) , can be modeled using multi-winner elections ( Elkind et al. , 2017 ; Faliszewski et al. , 2017 ) , where more than one candidates may win , simultaneously . Outside of the obvious situation of elections , other multi-winner election scenarios include canonical computer visions tasks like object recognition , which require models to recognize all the objects present in an image ( Boutell et al. , 2004 ) . Further , multi-winner problems arise when inferring the topics written about in a corpus of text ( document ) : e.g. , a news article may discuss one or more topics like politics , finance , or education . Another principal setting is healthcare , in which patient data ( e.g. , symptom reports or X-rays ) may be indicative of multiple conditions ( Irvin et al. , 2019 ; Johnson et al. , 2019 ) . We thus focus on creating private mechanisms for releasing the outcome of a multi-winner election . We first formalize the multi-winner election and then provide a solution , termed Binary voting , where we apply a single-winner election mechanism independently to each of the k candidates . Though simple , we prove that it is optimal when there is a lack of correlation among the outcomes of particular candidates . We then derive tighter data-independent privacy bounds for multi-winner elections by considering the situation where each voter is limited in their ( ` 2 ) votes for candidates , which we call τ voting . By casting multi-winner elections to an analogous task of single-winner elections , we create a third mechanism termed Powerset voting , which reveals the result for all k candidates jointly . By replacing the noisy arg max mechanism used in ( single-label ) PATE , we create multi-label PATE which enables multi-label privacy-preserving classification with semi-supervised machine learning . We empirically evaluate our algorithms on large-scale datasets , including the common multi-label benchmark Pascal VOC and three healthcare datasets , CheXpert ( Irvin et al. , 2019 ) , MIMIC ( Johnson et al. , 2019 ) , and PadChest ( Bustos et al. , 2020 ) . We compare our work against DPSGD , which can be directly applied to multi-label machine learning , and find that our approaches achieve new state-of-the-art privately trained models , with 85 % AUC ( 17 % better than DPSGD ) on the Pascal VOC dataset . Because many multi-label settings may benefit from distributed , multi-site learning ( e.g. , healthcare ) , we further integrate our methods with the collaborative protocol of Choquette-Choo et al . ( 2021 ) . We find that training with our mechanisms can improve model performance significantly on large , real-world healthcare data with sensitive attributes . Our main contributions are as follows : 1 . We create three new DP aggregation mechanisms for private multi-winner voting : Binary voting , τ voting , and Powerset voting . We theoretically analyze the privacy guarantees of these mechanisms , finding that Binary voting performs better unless there is high correlation among labels . 2 . We integrate our mechanisms with PATE , enabling private multi-label semi-supervised learning that achieves SOTA performance on large real-world tasks : Pascal VOC and 3 healthcare datasets . 3 . We enable multi-label collaborative learning in the multi-site scenario by integrating our mechanisms into CaPC . We find that multi-label CaPC significantly improves model performance . 2 BACKGROUND . 2.1 DIFFERENTIAL PRIVACY FOR MACHINE LEARNING . Differential Privacy ( DP ) is a canonical framework for measuring the privacy leakage of a randomized algorithm ( Dwork et al. , 2006 ) . It requires the mechanism , the training algorithm in our case , to produce statistically indistinguishable outputs on any pair of adjacent datasets , i.e. , datasets differing by only one and any data point . This bounds the probability of an adversary inferring properties of the training data from the mechanism ’ s outputs . Definition 1 ( Differential Privacy ) . A randomized mechanism M with domain D and range R satisfies ( ε , δ ) -differential privacy if for any subset S ⊆ R and any adjacent datasets d , d′ ∈ D , i.e . ‖d− d′‖1 ≤ 1 , the following inequality holds : Pr [ M ( d ) ∈ S ] ≤ eεPr [ M ( d′ ) ∈ S ] + δ . We use Rényi Differential Privacy ( RDP ) ( Mironov , 2017 ) which enables tighter accounting for our mechanisms using Gaussian noise because of its use of the Rényi-divergence to bound privacy loss . RDP is a generalization of pure , δ = 0-DP so we convert to and report final budgets using ( ε , δ ) −DP . Definition 2 . Rényi Differential Privacy ( Mironov , 2017 ) . We say that a mechanismM is ( λ , ε ) RDP with order λ ∈ ( 1 , ∞ ) if for all neighboring datasets X , X ′ : Dλ ( M ( X ) ||M ( X ′ ) ) = 1 λ− 1 logEθ∼M ( X′ ) [ ( pM ( X ) ( θ ) pM ( X′ ) ( θ ) ) λ ] ≤ ε It is convenient to consider RDP in its functional form as εM ( λ ) , which is the RDP ε of mechanism M at order λ . We now state the result which our privacy analysis builds on . Lemma 2.1 . RDP-Gaussian mechanism ( for a single-label setting ) ( Mironov , 2017 ) . Let f : X → R have bounded ` 2 sensitivity for any two neighboring datasetsX , X ′ , i.e. , ‖f ( X ) − f ( X ′ ) ‖2 ≤ ∆2 . The Gaussian mechanismM ( X ) = f ( X ) +N ( 0 , σ2 ) obeys RDP with εM ( λ ) = λ∆ 2 2 2σ2 . Another notable advantage of RDP over ( ε , δ ) -DP is that it composes naturally . This will be helpful when analyzing our approach which repeatedly applies the same private mechanism to a dataset . Lemma 2.2 . RDP-Composition ( Mironov , 2017 ) . Let mechanismM = ( M1 , . . . , Mt ) whereMi can potentially depend on outputs ofM1 , . . . , Mi−1.M obeys RDP with εM ( · ) = ∑t i=1 εMi ( · ) . 2.2 PATE AND CAPC . PATE ( Private Aggregation of Teacher Ensembles ) is a model agnostic algorithm for training ML models with DP guarantees ( Papernot et al. , 2017 ) . Rather than training a single model on a dataset , PATE trains an ensemble of models from ( disjoint ) partitions of the dataset . Each model , called a teacher , is then asked to predict on a test input and to vote for one class . Teacher votes are collected into a histogram where ni ( x ) indicates the number of teachers who voted for class i . To preserve privacy , PATE relies on the noisy argmax mechanism and only reveals a noisy aggregate prediction ( rather than revealing each prediction directly ) : argmax { ni ( x ) + N ( 0 , σ2G ) } , where the variance σ2G of the Gaussian controls the privacy loss of revealing this prediction . A student model learns in a semi-supervised fashion by querying the ensemble of teachers for noisy labels , where each label incurs additional privacy loss . Loose data-independent guarantees are obtained through advanced composition ( Dwork et al. , 2014 ) and tighter data-dependent guarantees ( see Appendix Section L ) are possible when there is high consensus among teachers on the predicted label ( Papernot et al. , 2018 ) . To further reduce privacy loss , Confident GNMax only reveals predictions that have high consensus : maxi { ni ( x ) } is compared against a noisy threshold also sampled from a Gaussian with variance σ2T . PATE was created for single-label classification ; our work extends it to the multi-label setting . CaPC ( Confidential and Private Collaboration ) is a distributed collaborative learning framework that improves on PATE ( Choquette-Choo et al. , 2021 ) . In addition to protecting the privacy of training data through differential privacy , CaPC also protects the confidentiality of test data and model parameters by introducing new cryptographic primitives . Confidentiality refers to the notion that no other party ( or adversary ) can view , in plaintext , the data of interest—it protects the inputs to our mechanism . This differs from differential privacy which protects what can be inferred ( in our case about the training set for PATE models ) from the outputs of our mechanism . Both protect data privacy in different ways . In CaPC , each teacher model is trained by a distinct ( and different ) protocol participant . The querying party initiates the protocol by ( 1 ) encrypting unlabeled data and the other ( answering ) parties return an encrypted label . Then , ( 2 ) the encrypted vote is secretly shared with both the answering party and the Privacy Guardian , where the Privacy Guardian follows PATE to enforce DP . Finally , ( 3 ) the Privacy Guardian engages in the secure computation with the querying party and returns a DP vote to the querying party . The detailed CaPC protocol can be found in Algorithm 1 of Appendix J . 2.3 PRIOR WORK ON MULTI-LABEL CLASSIFICATION . The closest to our work is that of Zhu et al . ( 2020 ) , which provides a privacy-preserving nearest neighbors algorithm formulated using PATE . The nearest-neighbor training points are used as teachers , where their labels are the votes . While this work is applicable to the multi-label setting , it assumes the existence of a publicly-available embedding model , which is used to project high-dimensional data onto a sufficiently-low-dimensional manifold for the meaningful computation of distances ( to determine the nearest neighbors ) . Instead , our approach does not make this assumption . Furthermore , we also show in Section 3 that clipping votes to the ` 1 ball , as done in Zhu et al . ( 2020 ) , is not optimal—given that noise is sampled from a Gaussian distribution . Instead , we obtain tighter bounds by clipping votes to an ` 2 ball . The multi-label voting problem can also be formulated as simultaneously answering multiple counting queries which has been studied extensively in the theoretical literature . Though data-independent optimal error bounds for the privacy loss were proven by Dagan & Kur ( 2020 ) , these mechanisms do not generally have data-dependent bounds and have yet to show promise empirically in settings such as multi-label voting . Another alternative multi-label method is differentially private stochastic gradient descent ( DPSGD ) , which was proposed by Abadi et al . ( 2016a ) and applied to the multi-label setting by Zhang et al . ( 2021 ) to train small multi-label models ( k = 5 labels ) . We compare directly with their work and find that our methods perform better . We present a detailed description of the related work in Appendix E. Finally , we stress that our evaluation includes large-scale healthcare datasets with a natural need for privacy and the additional challenge of being severely imbalanced .

Summary: The authors study differentially private multi-winner voting, which is designed for multi-label learning subject to a privacy constraint meant to limit information leakage about training data to an adversary. They propose three mechanisms: Binary, which essentially runs an existing differentially-private election for each label independently, \tau voting, which works with votes that have bounded \ell_2 norm, and powerset voting, which explicitly encodes each possible subset of winners as an alternative in an election and then votes over them. They show that Binary voting (the naive approach) generally outperforms powerset voting as long as there aren’t strong correlations between votes. Lastly, they show that they can use these multi-winner DP techniques to a extend single-label technique, PATE, and empirically demonstrate the effectiveness of their approach.