Paper: Functional Classification Under Local Differential Privacy with Model Reversal and Model Average (ICLR-2024)

Reviewer comment (Novelty):
Differential Privacy (DP) has already proven to be sufficiently effective in protecting individual privacy, for instance, in defending against membership inference attacks. Moreover, there are numerous existing methods within DP for adding noise to functional input data, where the idea of projecting onto a set of finite bases is also quite common. From this perspective, the innovation of projection might not be high enough, and the necessity of employing Local Differential Privacy (LDP) remains to be further examined.

Author response:
We thank the reviewer for the insightful comments. In response to these concerns, we provide responses from the following two perspectives.

1. **A comparison of DP and LDP**: Indeed, **Differential Privacy (DP)** is a foremost framework for privacy-preserving statistical analyses. It offers a rigorous and interpretable definition of data privacy, limiting the amount of information that attackers can infer from publicly released database queries. In most scenarios, the privacy protection required can be adequately addressed with DP. **Local Differential Privacy (LDP)**, on the other hand, is designed for more extreme cases, such as when the data collector is untrustworthy or malicious, or when privacy must be safeguarded right from the data collection stage, particularly in instances involving highly sensitive or personal data. **For example**, LDP is crucial in situations like smart home devices collecting user behavior data, mobile keyboard apps processing sensitive text inputs, and health monitoring wearables tracking personal health metrics.

2. **Functional data analysis (FDA) under LDP vs DP**: As the reviewer pointed out, there are existing works about projecting data onto a finite basis within DP. In the revised manuscript's **Section 2**, we've summarized existing DP methods for adding noise to functional data. However, FDA under LDP and DP faces different challenges. **First of all**, under DP, the server can access all the raw data and achieve privacy protection by utilizing knowledge of the covariance function and sensitivity of functional objects. In contrast, LDP requires each functional object to be privatized before senting to the server. **Furthermore**, under LDP, the emphasis is on the performance of models trained on the noised functional observations from clients, rather than on the recovery of functional data.

Reviewer comment (Theory):
The performance degradation caused by residuals has not been analyzed theoretically. The expressive power of a finite basis is quite limited, and for some functions, their residuals could be fatal.

Author response:
Thanks for pointing out the problem about expressive power of a finite basis. In the revised manuscript, we offered a detailed discussion on finite basis projection from various perspectives in **Section 3.1**, present some **theoretical analysis in Appendix B.1**, and provide a more intuitive demonstration using **real data in Appendix A.5**. We explained the acceptability of finite basis projection under LDP from the following perspectives:

1. **Functional data fitting**: According to [Eubank, 1999], when fitting functional observations with common basis functions, the number of basis needed for optimal estimation risk increases slowly with the number of observed time points $T$. Taking cubic B-Spline (with order $m=4$) as an example, the estimation risk decays at the optimal rate of $T^{-2m/(2m+1)}$ as the number of inner knots $K$ grows like $T^{1/(2m+1)}$. With the number of basis $d=m+K$, finite B-Spline basis can effectively fit the data;

2. **Performance of projection-based classifiers**: **Lemma 1 in Appendix B.1** demonstrates that under certain conditions, classifiers based on projection with finite basis can achieve the lowest possible misclassification rate among all possible classifiers;

3. **Functional projection under LDP**: Projection-based methods enable the server to efficiently capture data patterns of interest, such as using Fourier basis for specific frequency bands or B-Spline for certain intervals. Employing finite basis helps capture population-level patterns while preventing overfitting to individual differences and enhances communication efficiency;

4. **Real data**: **Figure 8 in Appendix A.5** visualizes functional observations from a phonemes dataset analyzed in **Section 6**. It also shows the curves reconstructed after finite basis projection and transformation. The projection (and transformation) erases individual detail information but retains the fluctuating pattern of individual curves, and the population-level group differences is also preserved.

[Eubank, 1999] Randall L Eubank. Nonparametric regression and spline smoothing. CRC press, 1999.

Reviewer comment (Experiments):
Regarding the ideas of model average and model reversal proposed by the authors, compared to traditional ensemble techniques, model average utilizes more clients in the evaluation process, aiming to select better weak classifiers. For each poor classifier, a model reversal approach is employed for improvement. However, since only a small number of clients are used to train the parameters, the classifiers might generally perform poorly; model reversal can enhance the performance of the learners, but it may not necessarily improve them to a satisfactory level.

Author response:
Thanks for pointing out the potential issues within Model Reversal (MR). We have addressed these in our revised manuscript by adding experimental results of classifiers based on MR, including experiments with weak classifiers trained using varying sample sizes, and by revising the content of Theorem 3.

**Experimental Performance of MR**

- From **Figure 1 in Section 5**, we observed that MR significantly improves the performance of all types of weak classifiers. And compared to Model Average (MA), the MRMA-based classifiers further substantially enhances the performance of SVM and CG classifiers;
- In **Appendix A.4**, experimental results show that the number of clients used to train weak classifiers does not affect the efficacy of MR or MRMA in improving classifier performance. Additionally, when more client data is available, allocating more data for validation (i.e., for MR and MA) yields better results than using it solely to strengthen weak classifiers.

**Theoretical Analysis of MR**

- Given a classifier's accuracy rate distribution under $\varepsilon$-LDP as $p_\varepsilon(r)$ with $r\in[0,1]$, **Theorem 3** measures the potential improvement in classification accuracy through MR;

- Although a detailed theoretical analysis of the distribution $p_\varepsilon(r)$ for various classifiers is beyond this paper's scope, it's evident from **Figure 1 in Section 5** and **Figure 3 in Appendix A.2** that different weak classifiers have varying sensitivities to noise and exhibit different distributions $p_\varepsilon(r)$. This variation explains why MR offers more improvement for SVM and CG classifiers than Logistic and DWD classifiers in experiments, especially at lower values of $\varepsilon$.

Reviewer comment (Theory):
Theorem three provides an expected conclusion, but it does not directly lead to a high-probability bound; the theoretical analysis of model reversal is still lacking.

Author response:
Thanks for pointing out the potential issues within Model Reversal (MR). We have addressed these in our revised manuscript by adding experimental results of classifiers based on MR, including experiments with weak classifiers trained using varying sample sizes, and by revising the content of Theorem 3.

**Experimental Performance of MR**

- From **Figure 1 in Section 5**, we observed that MR significantly improves the performance of all types of weak classifiers. And compared to Model Average (MA), the MRMA-based classifiers further substantially enhances the performance of SVM and CG classifiers;
- In **Appendix A.4**, experimental results show that the number of clients used to train weak classifiers does not affect the efficacy of MR or MRMA in improving classifier performance. Additionally, when more client data is available, allocating more data for validation (i.e., for MR and MA) yields better results than using it solely to strengthen weak classifiers.

**Theoretical Analysis of MR**

- Given a classifier's accuracy rate distribution under $\varepsilon$-LDP as $p_\varepsilon(r)$ with $r\in[0,1]$, **Theorem 3** measures the potential improvement in classification accuracy through MR;

- Although a detailed theoretical analysis of the distribution $p_\varepsilon(r)$ for various classifiers is beyond this paper's scope, it's evident from **Figure 1 in Section 5** and **Figure 3 in Appendix A.2** that different weak classifiers have varying sensitivities to noise and exhibit different distributions $p_\varepsilon(r)$. This variation explains why MR offers more improvement for SVM and CG classifiers than Logistic and DWD classifiers in experiments, especially at lower values of $\varepsilon$.

Reviewer comment (Evaluation):
Are there specific scenarios or use cases where LDP provides a clear advantage over DP in functional data classification?

Author response:
We apologize for not clearly distinguishing between LDP and DP in the original manuscript. As mentioned in the revised manuscript's Introduction and in response to **Weakness 1 (1/2)**, DP is sufficient for privacy protection in most scenarios. LDP is designed for more extreme cases, such as when dealing with untrustworthy or malicious data collectors, especially in situations involving highly sensitive or personal data. Here are two specific examples concerning remote health monitoring and fitness data where it is necessary to add noise at the individual data level before centralization:

1. **Remote Health Monitoring Scenario** Consider a scenario where a remote health monitoring system is implemented by a healthcare provider. In this scenario, continuous health data, such as heart rate, blood pressure, and sleep patterns, are collected from patients through wearable devices. This sensitive data, once acquired by an untrusted server, could potentially be used to infer medical conditions or health status categories of the patients. Such inferences could then be utilized for various purposes, ranging from personalized healthcare and treatment plans to potentially more intrusive uses like health insurance premium adjustments or targeted advertising based on perceived health risks.

2. **Fitness Data Collection Scenario** In another scenario, a fitness app collects detailed data on user activities, including step count, exercise routines, and physiological responses to workouts, from wearable fitness trackers. If this data falls into the hands of an untrusted server, it could be used to deduce categories such as fitness levels, lifestyle habits, or even underlying health issues of the users. Consequently, this information might be exploited for purposes like customizing fitness programs, but it also raises concerns about privacy breaches, where users’ fitness data could be used for unsolicited health product marketing or influence health insurance policies without the users' explicit consent.

Reviewer comment (Novelty):
The idea of projecting data onto a finite basis is quite common in the realm of DP. Could you clarify how your approach innovates or differs significantly from existing methods?

Author response:
We apologize for not making everything clear. The idea of projecting data onto a finite basis is indeed a commonly employed method. However, as we discussed in **Section 2** of the revised manuscript and in our response to **Weakness 1 (1/2)**, functional data analysis under DP or LDP faces distinctly different challenges. In the context of LDP, privacy learning with functional data, through finite basis projection, effectively reduces dimensionality to lessen noise interference, while simultaneously ensuring less impact on the efficacy of the learned models. Our paper is the first to consider privacy learning with functional data under LDP. We also propose novel techniques, Model Reversal and Model Average, tailored for LDP, to enhance classifier performance.

For a detailed overview of the novelty of our work, we refer to **General response** for a discussion.

Reviewer comment (Novelty):
The setting seems obscure and not very well-motivated. I don’t really understand the significance of functional data and where it’s found in real-world applications.

Author response:
Thanks for pointing it out! We've realized our article lacked an introduction to functional data and its privacy aspects. In response, we have now included in **Section 1 (Introduction)** a brief overview of functional data and the importance of privacy preservation, along with relevant examples. Additionally, **Section 6 (Real Application)** has been updated to include a real data application to demonstrate these concepts in practice.

- **Functional data analysis (FDA)** is a branch of statistics that deals with data that is densely observed over a continuum, such as time or space. This type of data is distinct from traditional multivariate data, which typically consists of a finite number of variables measured at a discrete set of points. FDA is widely used in various fields **such as** economics (for analyzing financial time series), environmental sciences (for studying climate change effects), health sciences (for analyzing continuous health monitoring data), and engineering (for signal processing). And privacy preservation in functional data is also crucial in domains **such as** health informatics, where hospital patient monitoring systems can reveal sensitive health information, and in behavioral science, where data from smart devices can provide deep insights into an individual's lifestyle and habits.

Reviewer comment (Experiments):
I’m not fully convinced by the empirical evaluation. The experimental results show that the proposed techniques improve classification performance, but at the same time the baselines don’t set a particularly high bar to beat. While I understand that a little-explored setting won’t have much previous work to compare to, it is still hard to judge the importance of the methods without them. And touching back on Weakness #1, the experiments are all conducted on a synthetic dataset and so it’s unclear how well the methods will generalize to real-world data.

Author response:
We thank the reviewer for the insightful comments. In the revised version of our paper, we have supplemented it with comparative experiments and added a real-world application.

- **Experimental Results**: In **Figure 1 of Section 5**, we supplemented results for classifiers based on classic aggregation methods, "Voting" and "Averaging". It’s evident that under LDP, these classic methods are ineffective. However, our proposed techniques, both Model Reversal (MR) and Model Average (MA), significantly improve the performance of all types of weak classifiers, even at lower $\varepsilon$ values, which corresponds to higher levels of privacy protection. MRMA, in particular, substantially further enhances the performance of SVM and CG classifiers. Similar results can also be found in **Figure 7 in Appendix A.4**. As the reviewer mentioned, since this is the first paper to study functional classification, our simulations lacked existing methods for comparison. If there are any additional suggestions for comparison, please let us know.

- **Real Application**: In **Section 6 (Real Application)**, we employed our methods on a phonemes dataset derived from the TIMIT Speech Corpus. To ensure the robustness and reliability of our results, we conducted 500 random splits of the dataset into test, training, and validation sets. The performance of various methods in this real-world application was similar to that observed in the simulations, with classifiers based on MR and MA still showing good performance.

Reviewer comment (Writing):
Is there a formal definition for a “weak classifier”?

Author response:
I apologize for the lack of clarity in our paper. We introduced the process of generating weak classifiers during the training phase in **Section 3.3** of our paper. And in the context of machine learning, a "weak classifier" generally refers to a simple model that performs only slightly better than a random guesser in classifying instances into classes. This concept is often discussed in ensemble learning methods, particularly in boosting algorithms.

Reviewer comment (Novelty):
The functional data classifiers are constructed under LDP, and then it seems to me that the LDP setting is kind of irrelevant to the rest of the paper (or at least, to the model average and model reversal techniques). Similarly for the functional data setting, after dimensionality reduction and re-scaling. Do MA and MR actually have anything to do specifically with LDP (or with functional data), or are they general techniques that could be used to improve the performance of any collection of weak classifiers?

Author response:
We apologize for not making the relationship among LDP, functional data, and MRMA clear. In this paper, we proposed a new technique, **Model Reversal**, to enhance the performance of a single weak classifier under LDP. We also introduced a **Model Average** approach tailored for LDP to obtain a better collection of weak classifiers. And the data allocation ratio for training and validation sets, as well as the validation process used in our MRMA technique, are all specifically designed for LDP.

Here, we provide a more detailed explanation of the relationship among LDP, functional data, and MRMA:

- **LDP and MR (Model Reversal)**: MR is a new technique we developed to improve the performance of weak classifiers under LDP. Under LDP, it's common for weak classifiers to have misclassification rates greater than $50\%$ due to high noise in the data, and using MR can lead to significant improvements. In **Theorem 3 of Section 3.3**, we measured the enhancement that model reversal can bring to the classifier;

- **LDP and MA (Model Average)**: MA in our paper is designed specifically for LDP challenges. Specifically, we proposed a method to evaluate the performance of weak classifiers under LDP in **Theorem 2 of Section 3.3**. And based on the evaluation, we assigned more suitable weights to these classifiers during the collection process;

- **Functional data and MRMA**: Our MRMA algorithm is applicable to functional data as well as other data types. After obtaining weak classifiers trained on various data types under LDP, it can be used to construct a better-performing classifier

Reviewer comment (Theory):
It would be better if the authors could add some intuition and discussion about the result in Theorem 2 and 3.

Author response:
Thanks for the kind advice. We have now incorporated discussions in the revised manuscript.

- In **Theorem 2**, we demonstrated that the validation process adheres to Local Differential Privacy (LDP). We then provided an unbiased estimate of the classifier's accuracy rate and the variance of this estimate. The accurate assessment of the classifier's performance is a fundamental prerequisite for the subsequent enhancement of the classifier's performance through  Model Reversal and Model Average (MRMA).
- We have enriched the content of **Theorem 3**. This theorem measures the improvement in classification accuracy that can be achieved through Model Reversal (MR) when the distribution of classification accuracy rate of a classifier, constructed under $\varepsilon$-LDP, is known to be $p_\varepsilon(r)$ with $r\in[0,1]$.

Reviewer comment (Novelty):
The proposed method is built on the dimension reduction scheme and laplace mechanism which does not seem to be very novel.

Author response:
We apologize for not sufficiently highlighting the novelty of our work in the original submission. Indeed, the dimension reduction scheme and the Laplace mechanism are well-established methods. However, our paper focuses more on building a functional classifier and proposing the MRMA algorithm tailored for LDP to enhance classifier performance under LDP.

For a detailed overview of the novelty of our work, we refer to **General response** for a discussion.