G ENERATIVE A DVERSARIAL U SER P RIVACY IN L OSSY S INGLE -S ERVER I NFORMATION R ETRIEVAL
Anonymous authors
Paper under double-blind review
A BSTRACT
We consider the problem of information retrieval from a dataset of ﬁles stored on a single server under both a user distortion and a user privacy constraint.
Speciﬁcally, a user requesting a ﬁle from the dataset should be able to reconstruct the requested ﬁle with a prescribed distortion, and in addition, the identity of the requested ﬁle should be kept private from the server with a prescribed privacy level.
The proposed model can be seen as an extension of the well-known concept of private information retrieval by allowing for distortion in the retrieval process and relaxing the perfect privacy requirement.
We initiate the study of the tradeoff between download rate, distortion, and user privacy leakage, and show that the optimal rate-distortion-leakage tradeoff is convex and that in the limit of large ﬁle sizes this allows for a concise information-theoretical formulation in terms of mutual information.
Moreover, we propose a new data-driven framework by leveraging recent advancements in generative adversarial models which allows a user to learn efﬁcient schemes in terms of download rate from the data itself.
Learning the scheme is formulated as a constrained minimax game between a user which desires to keep the identity of the requested ﬁle private and an adversary that tries to infer which ﬁle the user is interested in under a distortion constraint.
In general, guaranteeing a certain privacy level leads to a higher rate-distortion tradeoff curve, and hence a sacriﬁce in either download rate or distortion.
We evaluate the performance of the scheme on a synthetic Gaussian dataset as well as on the
MNIST dataset.
For the MNIST dataset, the data-driven approach signiﬁcantly outperforms a proposed general achievable scheme combining source coding with the download of multiple ﬁles.
I NTRODUCTION
Machine learning (ML) has been recognized as a game-changer in modern information technology, and various ML techniques are increasingly being utilized for a variety of applications from intrusion detection to image classiﬁcation and to recommending new movies.
Efﬁcient information retrieval (IR) from a single or several servers storing such datasets under a strict user privacy constraint has been extensively studied within the framework of private information retrieval (PIR).
In PIR, ﬁrst introduced by Chor et al.
(Chor et al., 1995), a user can retrieve an arbitrary ﬁle from a dataset without disclosing any information (in an information-theoretic sense) about which ﬁle she is interested in to the servers storing the dataset.
Typically, the size of the queries is much smaller than the size of a ﬁle.
Hence, the efﬁciency of a PIR protocol is usually measured in terms of the download cost, or equivalently, the download (or PIR) rate, neglecting the upload cost of the queries.
PIR has been studied extensively over the last decade, see, e.g., (Banawan & Ulukus, 2018; Freij-Hollanti et al., 2017; Kopparty et al., 2011; Sun & Jafar, 2017; Tajeddine et al., 2018; Yekhanin, 2010) and references therein.
Recently, there has been several works proposing to relax the perfect privacy condition of PIR in order to improve on the download cost, see, e.g., (Lin et al., 2020; Samy et al., 2019; Toledo et al., 2016).
Inspired by this line of research, we propose to simultaneously relax both the perfect privacy condition and the perfect recovery condition, by allowing for some level of distortion in the recovery process of the requested ﬁle, in order to achieve even lower download costs (or, equivalently, higher download rates).
We concentrate on the practical scenario in which the dataset is stored on a single server.
A problem formulation with arbitrary distortion and leakage functions is presented, which establishes a tri-fold tradeoff between download rate, privacy leakage to the server storing the dataset, and distortion in the recovery process for the user.
We show that the optimal rate-distortion-leakage tradeoff is convex (see Lemma 1) and that it allows for a concise information-theoretical formulation in terms of mutual information in the limit of large ﬁle sizes (see Theorem 1).
In the special case of full leakage to the server, the proposed formulation yields the well-known rate-distortion curve.
The typical behavior of the rate-distortion-leakage tradeoff is illustrated in Fig.
1, showing that an increased level of privacy leads to a higher rate-distortion tradeoff curve, and hence a sacriﬁce in either download rate or distortion.
A general achievable scheme combining source coding with the download of multiple ﬁles is proposed for datasets with a known distribution.
Moreover, to overcome the practical limitation of unknown statistical properties of real-world datasets, we consider a data-driven approach leveraging recent advancements in generative adversarial networks (GANs) (Goodfellow et al., 2014), which allows a user to learn efﬁcient schemes (in terms of download rate) from the data itself.
In our proposed GAN-based framework, learning the scheme can be phrased as a constrained minimax game between a user which desires to keep the identity of the requested ﬁle private and a server that tries to infer which ﬁle the user is interested in, under both a user distortion and a download rate constraint.
Similar to (Springenberg, 2016), where a cross-entropy loss function is used as a discriminative classiﬁer for unlabeled or partially labeled data, the server is modeled as a discriminator in the generalized GAN framework, and also trained with cross-entropy for labeled data.
We evaluate the performance of the proposed scheme on a synthetic Gaussian dataset as well as on the MNIST (Lecun et al., 1998) dataset.
For the MNIST dataset, the data-driven approach signiﬁcantly outperforms the proposed achievable scheme, while for the Gaussian dataset, where the source statistics is known, it performs close to the proposed achievable scheme using a variant of the generalized Lloyd’s algorithm (Lloyd, 1982; Linde et al., 1980) for the source code.
[Figure]
Related Work
As outlined above, in this work we consider “information retrieval” in the sense of PIR, while “information retrieval” in the traditional sense used by the information retrieval community has a different meaning.
In particular, in the traditional sense “information retrieval” refers to the problem of providing a list of documents given a query and has a wide range of applications (Baeza-Yates et al., 1999).
In Wang et al.
(2017), the authors proposed to iteratively optimize two well-established models of traditional information retrieval; namely generative retrieval focusing on predicting relevant documents given a query and discriminative retrieval focusing on predicting document relevance given a query and document pair.
The resulting optimization problem is formulated as a minimax game.
Due to differences in system model there is no clear connection to our proposed framework, besides the formulation as a minimax game.
Similar data-driven approaches, under the names of generative adversarial privacy (Huang et al., 2017; 2018), privacy-preserving adverisal networks (Tripathy et al., 2019), and compressive privacy
GAN (Tseng & Wu, 2020), have recently been proposed for learning a privatization mechanism directly from the dataset in order to release it to the public and for generating compressed representations that retain utility while being able to withstand reconstruction attacks.
A similar approach was also taken in (Blau & Michaeli, 2019) where a tri-fold tradeoff between rate, distortion, and perception in lossy image compression was established.
Relaxing the perfect information-theoretical privacy condition by considering computationally-private information retrieval where the privacy requirement relies on an intractability assumption (e.g., the hardness of deciding quadratic residuosity) has been investigated in several previous works, see, e.g., (Kushilevitz & Ostrovsky, 1997; 2000;
Lipmaa, 2005).
Hence, given inﬁnite computational power, the requested ﬁle index can be determined precisely.
Moreover, in (Kadhe et al., 2020), it was shown that allowing for side information can also decrease the download cost in single-server PIR.
In contrast to these previous works, here we propose to relax the perfect reconstruction constraint in order to decrease the download cost.
Moreover, to the best of our knowledge, addressing PIR or the extension to nonperfect privacy and recovery in the context of generative adversarial models has not been considered in the open literature so far.
P RELIMINARIES AND S YSTEM M ODEL 2. N OTATION
We denote [ a ] (cid:44) { 1 , 2 , . . .
, a } .
An arbitrary ﬁeld is denoted F , while the set of nonnegative real numbers is denoted by R ≥ 0 .
Vectors are denoted by bold letters and sets by calligraphic uppercase letters, e.g., x and X , respectively.
We use uppercase letters for random variables (RVs) (either scalar or vector), e.g., X or X .
For a given index set [ M ] , we write X [ M ] to represent (cid:8) X ( m ) : m ∈
[ M ] (cid:9) .
E X [ · ] and E P X [ · ] denote expectation with respect to the RV X and the probability mass function
P X , respectively.
H ( X ) or H ( P X ) represents the entropy of X , while I ( X ; Y ) denotes the mutual information (MI) between X and Y .
The multivariate Gaussian distribution with mean µ and covariance matrix Σ is denoted as N ( µ , Σ) .
In particular, if the entries of this distribution are mutually independent, we have Σ = σ 2 I , for marginal standard deviation σ ∈ R ≥
and I denoting the identity matrix.
The transpose of a vector is denoted as ( · ) (cid:124) .
2. S INGLE -S ERVER I NFORMATION R ETRIEVAL
Consider a dataset containing M ﬁles X (1) , . .
, X ( M ) stored on a single server, where each ﬁle
X ( m ) =
(cid:0) X ( m ), . . .
, X ( m ) β (cid:1) (cid:124) , m ∈
[ M ] , can be seen as a β × 1 random vector (according to some probability distribution P X ( m ) ) over F β , where F is any ﬁeld (ﬁnite or inﬁnite).
Assume that the user wishes to retrieve the M -th ﬁle, M ∈ [ M ] , where, for simplicity, M is assumed to be uniformly distributed over [ M ] .
The formal deﬁnition of a general single-server IR scheme is as follows.
Deﬁnition 1.
An IR scheme C for a single-server storing M ﬁles consists of: (i)
A random strategy
S .
(ii)
A deterministic query function f Q that generates a query Q = f Q ( M, S ) , where query Q is sent to the server.
(iii)
A deterministic answer function f
A that returns the answer A =
f A ( Q , X
[ M ] ) back to the user.
(iv) A deterministic reconstruction function ˆ X (cid:44) f ˆX ( A , M, Q ) giving an estimate of the desired ﬁle using the answer from the server together with the requested ﬁle index M and the query Q .
Note that the server does not use S directly to produce A and thus using Q is sufﬁcient in the reconstruction.
We are interested in designing an IR scheme such that both the user’s utility and privacy are preserved.
On the one hand, this scheme should satisfy the condition of retrievability with a distortion measure d ( · , · ) , i.e.,
[Equation]
where D is a given distortion constraint.
On the other hand, the user would like to preserve her privacy with the query function, in the sense that the server should not be able to fully determine the identity M of the requested ﬁle.
The server receives the query Q , and the leakage is measured in terms of a leakage metric ρ ( P Q | M ) .
The query function should be designed such that
[Equation]
where L is the maximum allowed leakage.
Moreover, it is worth mentioning that unlike the setting of classical PIR, where perfect retrievability is ensured for every ﬁle, i.e., E Q (cid:2)
d ( X ( m ) , ˆ X ) (cid:3) = 0 for all m ∈
[ M ] , the distortions for different ﬁles need not be the same.
In other words, it is possible to have E Q (cid:2)
d ( X ( m ) , ˆ X ) (cid:3) (cid:54) =
E Q (cid:2) d ( X ( m (cid:48) ) , ˆ X ) (cid:3) for m (cid:54) = m (cid:48) , and (1) can be expressed as
[Equation]
Given a query function f Q and an answer function f A of an IR scheme, we measure its efﬁciency in terms of the download rate (in bits per symbol) deﬁned as
[Equation]
where (cid:96) q ( a ) is the length of the answer a for query q .
Further in the paper, the length (cid:96) q ( a ) is a constant (i.e., independent of a and q ) that is chosen according to the desired rate.
2. P ROBLEM F ORMULATION
[Figure]
We consider a model that protects the privacy of the user against a honest-butcurious server.
The IR model above guarantees that a user can retrieve an arbitrary ﬁle stored on a single server (with some distortion), while the server can only partially infer the identity of the requested ﬁle.
In this work, we will study the tri-fold tradeoff between download rate, expected distortion, and privacy leakage to the server for an IR scheme.
In particular, for a given constraint D on the expected distortion
E M, Q (cid:2) d ( X ( M ) , f ˆX ( A , M, Q )) (cid:3) for the retrieval of the requested ﬁle indexed by M and for a given constraint L on the leakage to the server ρ ( P Q | M ) , the goal is to minimize the download rate
R ( f Q , f A ) .
This can be formulated as the constrained optimization problem
[Equation]
subject to
[Equation]
To further capture the information leakage for training, we deﬁne ˆ M (cid:44) f ˆM ( Q ) to be the server’s inference of the user’s requested ﬁle index M from the query Q using a decision decoder f ˆM .
The proposed model is illustrated in Fig.
The leakage on the identity of the requested ﬁle can also be quantiﬁed by a loss function denoted as f Loss ( M, ˆ M ) .
Hence, the expected loss with respect to M and Q is
[Equation]
Here, the leakage metric ρ ( P Q | M ) in (2) is connected to the expected loss J ( f Q , f ˆM ) as ρ ( P Q | M ) =
max f ˆ M J ( f Q , f ˆM ) .
Note that the main objective is to minimize the user’s leakage to the server, which is equivalent to minimizing J ( f Q , f ˆM ) , while the goal of the server is the opposite, i.e., of making the user’s loss as large as possible or, equivalently, of maximizing J ( f Q , f ˆM ) .
Lemma 1.
The set of achievable (feasible) rate-distortion-leakage triples ( R , D , L ) from (4) is a convex set, for any leakage metric ρ that is convex in P Q | M .
We remark that Lemma 1 also holds for any loss function f Loss , since any ρ ( P Q | M ) that can be expressed via J ( f Q , f ˆM ) is always convex in P Q | M .
Note that if f Loss ( m, ˆ M ) is the 0 - 1 loss function (Nguyen & Sanner, 2013) it can be easily shown, following a similar argument as in Huang et al.
(2017, Sec. 2.2), that the optimal inference strategy for the server is the MAP decoder, and that the privacy metric ρ ( P Q | M ) in this case equals the server’s inference accuracy Pr( M = ˆ M ) .
This case is referred to as hard decision decoding.
However, if f Loss ( m, ˆ M ) is the log-loss function deﬁned as
[Equation]
then the leakage to the server is measured in terms of MI, i.e., ρ ( P Q | M )
=
I ( M ; Q ) .
This case is referred to as soft decision decoding.
Moreover, the detailed derivation, which can be found in
Appendix C, gives an explicit reason (see (C.12)) to use empirical categorical cross-entropy as loss function for the data-driven approach in Section 4.
It can be seen that the leakage metrics ρ we considered here are all convex in P Q | M .
Thus, in the rest of paper, we will always assume that the metric ρ ( · ) is convex in its argument.
Theorem 1.
The download rate given in (4) is equal to the following information rate-distortionleakage function deﬁned as
[Equation]
as β → ∞ , where
[Equation]
The proof that the rate R is bounded from below by R ( D , L ) , for any β , is given in Appendix B. While the achievability proof is not provided, we do give the following intuition and relative technique from information theory.
Note that our single-server IR scheme can be seen as a source coding problem with side information, where the server and the user act as an encoder and a decoder, respectively, and where the query can be seen as a controllable side information known to both the encoder and decoder in order to enforce the privacy condition.
This is similar to the well-known Wyner-Ziv problem (Wyner & Ziv, 1976).
Hence, a random-coding based scheme can be used to achieve
R ( D , L ) as β → ∞ .
Further, it can be shown that the alphabet size of the designed queries can be restricted to M + 4 , which follows from applying the Carathéodory’s theorem (Cover & Thomas, 2006, Thm. 15.3.5).
Note, however, that ﬁnding an analytical closed-form expression for R ( D , L ) in our case is intractable even for independent and identically distributed (i.i.d.) ﬁles.
Hence, we provide numerical results for Gaussian data in Section 5, which indicate that, by combining the achievable scheme proposed below in Section 3 with a convexifying approach, (6) is achievable.
2. G ENERATIVE A DVERSARIAL A PPROACH
The inference of the server can also be modeled in a generative adversarial fashion (Huang et al., 2017; 2018; Tripathy et al., 2019; Tseng & Wu, 2020).
In particular, the leakage-distortion tradeoff for any ﬁxed download rate constraint R is formally described as follows.
Consider a family of IR schemes with query generators f Q , answer functions f A , and with download rate R ( f Q , f A ) at most
R .
The goal of the server is to maximize the expected loss J ( f Q , f ˆM ) of the user by designing the decision function f ˆM .
In contrast, the user would like to design a scheme with f Q , f A , and f ˆX such that the download rate R ( f Q , f A ) ≤ R and such that the expected loss J ( f Q , f ˆM ) is minimized, while preserving the utility of the scheme, i.e., in the sense that the user can still retrieve the requested ﬁle with an expected distortion smaller than a prescribed D .
This leads to the constrained minimax optimization problem
[Equation]
subject to
[Equation]
Note that the minimax formulation in (7a) can be written in a GAN form (Goodfellow et al., 2014) in which f ˆM plays the role of the discriminator and f Q plays the role of the generator .
Thus, the machinery of GANs can be used to determine the leakage-distortion tradeoff.
In doing so, (7) is ﬁrst reformulated as the unconstrained optimization problem
[Equation]
where η 1 and η 2 are tuning parameters, and Q and A are according to Deﬁnition 1.
The minimax game in (8) with soft decision decoding, i.e., with the log-loss function in (C.11), will be the basis for training, as described below in Section 4.
A CHIEVABLE S CHEMES
In this section, we present a general achievable scheme for an arbitrary number of ﬁles M and hard decision leakage (or accuracy)
L ∈ { 1 , 1 / 2 , 1 / 3 , . .
, 1 / M } .
The construction is based on the following fact.
If L = 1 , then the problem becomes essentially the problem of lossy compression: the user explicitly tells the server what she needs to download, and the server sends the requested data compressed with some pre-agreed method.
One well-known example of such compression is quantization.
This scheme is designed against a maximum-likelihood decoder that provides the best inference for the server.
Assume that the user wishes to retrieve the M -th ﬁle and to ensure leakage of L = 1 / N , 1 ≤ N ≤ M .
We describe the steps of the scheme as follows.
• The user ﬁrst selects a lossy source coding scheme C to encode together N ﬁles of size β each.
Assume that the source coding scheme achieves an average compression size (in bits) of log 2 |C| and expected normalized distortion D (normalized by N β ), respectively.
• The user’s query is designed to exactly request N ﬁles with indices M 1 , . . .
, M N such that M ∈ { M 1 , . .
, M N } , where the N − 1 nondesired indices are chosen uniformly at random.
These N − 1 ﬁle indices are added in order to “trick” the server and hide the real ﬁle index M of interest.
• After receiving the queries sent by the user, the server compresses all N ﬁles by using the source coding scheme C , and transmits the answer back to the user.
• The user decompresses the answer using the selected source coding scheme.
The N −nondesired reconstructed ﬁles are discarded by the user, while the desired reconstructed ﬁle is kept.
The rate of the corresponding IR scheme is R = log 2 |C| /β , while the expected distortion is D and the leakage is L .
The performance of this scheme is strongly dependent on the used source coding scheme C .
Using Lemma 1, a scheme for any leakage 1 / M ≤ L ≤ 1 (not only reciprocal of an integer) can be constructed.
From the general scheme above, two speciﬁc schemes can be constructed based on the source coding scheme used.
The ﬁrst scheme is constructed by selecting a source coding scheme based on quantization.
In particular, we use a variant of the generalized Lloyd’s algorithm (Lloyd, 1982;
Linde et al., 1980).
In the sequel, we will refer to this scheme as the compression-based scheme.
The second scheme, referred to in the sequel as Shannon’s scheme, assumes β → ∞ and uses the well-known rate-distortion function from information theory for the source coding scheme (Gray, 1973).
In Fig. 3(a) below, together with a convexifying approach described in Appendix D.2, we plot the performance of both schemes for an i.i.d.
Gaussian dataset.
It is worth mentioning here that by numerically solve (6) for Gaussian data, the lower bound and the approximation values of
Shannon’s scheme are actually quite close, which shows that the converse bound is achievable for the i.i.d.
Gaussian case.
D ATA -D RIVEN A PPROACH
In this section, we describe in detail our proposed data-driven framework for constructing an efﬁcient
IR scheme for downloading an arbitrary ﬁle from an arbitrary dataset stored on a single server.
The four functions in Fig.
2 are represented as deep neural networks and we assume, for now, that they have already been trained.
The user wishes to retrieve the M -th ﬁle X ( M ) and encodes M as a one-hot Y =
( Y 1 , Y 2 , . . .
, Y M ) ∈ { 0 , 1 } M , where Y j = 1 if j = M , and Y j = 0 otherwise.
Next, the user generates a “noise” vector S =
( S 1 , S 2 , . . .
, S M ) , where S 1 , S 2 , . . .
, S M are i.i.d.
according to the standard Gaussian distribution N (0 , 1) .
The concatenation ( S 1 , S 2 , . . .
, S M , Y 1 , Y 2 , . . .
, Y M ) is the input to a deep neural network, representing the function f Q , for query generation.
This network produces the query
Q that is sent to the server.
The intuition behind this neural network is to hide the value of M .
The server’s answer is produced by concatenating the stored data X [ M ] and the received query Q and then feed the result into a deep neural network, representing the function f A , for answer construction.
The deep neural network produces the answer vector A that is sent back to the user.
The user then concatenates A and ( S 1 , . .
, S M , Y 1 , . . .
, Y M )
and feeds the result into a deep neural network for decoding, representing the function f ˆX , to produce the estimate ˆ X of the requested ﬁle X ( M ) .
On the server side, a deep neural network, representing the function f ˆM , is used to guess the identity of the requested ﬁle.
The input to the network is the query vector Q and the output (using softmax) is a distribution-like vector F
=
( F 1 , F 2 , . . .
, F M ) , where (cid:80) M j =1 F j = 1 , 0 ≤ F j ≤ 1 , and where F j can be interpreted as “with probability/likelihood F j , the user’s requested ﬁle index M is equal to j .”
The server’s estimate of the user requested ﬁle index is then ˆ M = arg max j ∈
[ M ] F j .
4. L EARNING A LGORITHM
Let X ( M
[Equation]
) = (cid:0)
[Equation]
, X ( M l )
[Equation]
(cid:1) , l ∈ [ n ] , denote the l -th requested ﬁle during training and ˆ X l the corresponding user reconstructed estimate, where n is the number of training samples.
Training the deep neural networks representing the functions f Q , f A , f ˆX , and f ˆM is done following (C.12) and (8) by ﬁrst ﬁxing the download rate R and then solving the minimax optimization problem
[Equation]
[Equation]
) where f XE-Loss ( Y l , F l ) = − (cid:80) M j =1 Y l,j log F l,j = − log F l,M l measures the categorical cross-entropy between the vectors Y l =
( Y l, 1 , . . .
, Y l, M ) and F l = ( F l, 1 , . . .
, F l, M ) .
Here, Y l and F l is the
Y -vector and F -vector for the l -th sample.
The parameter η is a tradeoff coefﬁcient that is increased in every epoch.
The solution to the minimax optimization problem in (9) is found using an iterative algorithm employing stochastic gradient decent similar to Algorithm 1 in Huang et al.
The solution is found by ﬁrst maximizing by the objective function of (9) to determine the optimal f ˆM for a ﬁxed initial triple ( f Q , f A , f ˆX ) .
Next, the optimal triple ( f Q , f A , f ˆX ) is found for the given f ˆM from the previous step by minimizing the same objective function.
This iterative process is continued until convergence or the maximum number of iterations is exceeded.
Note that, although training is done based on a log-loss function (see (C.11)), we evaluate the performance more intuitively using accuracy, i.e., Pr( M = ˆ M ) , in Section 5 below.
N UMERICAL R ESULTS
We demonstrate the application of our proposed data-driven approach to a synthetic Gaussian dataset and also for the MNIST dataset, showing that guaranteeing a certain privacy level leads to a higher rate-distortion tradeoff curve, and hence a sacriﬁce in either download rate or distortion.
We also compare the data-driven approach with both the compression-based scheme (for all datasets) and
Shannon’s scheme of Section 3 (for the Gaussian dataset).
The Gaussian dataset consists of M =ﬁles, each of dimension β = 3 and drawn independently according to N ( µ ( m ) , σ 2 I ) , where µ (1) =
( − 3 . 0 , − 3 . 0 , 3 . 0)
(cid:124) , µ (2) =
(3 . 0 , 3 . 0 , 3 . 0) (cid:124) , µ (3) =
(3 . 0 , − 3 . 0 , − 3 . 0) (cid:124) , µ (4) =
( − 3 . 0 , 3 . 0 , − 3 . 0)
(cid:124) , and σ = 3 .
For MNIST, the training set is comprised of n = 6000 and size 28 × 28 images for each digit, and testing is performed on randomly chosen images from 10000 test images.
The distortion between a requested ﬁle X ( m ) and its estimate ˆ X is measured as the per-symbol squared error.
The
CIFAR- 10 dataset consists of n = 5000 and size 32 × 32 pixels 3 channels training images for each classes.
There are 10 classes in CIFAR- 10 dataset
and there are 1000 testing images for each class.
In Fig.
3, we plot the accuracy, or Pr( M = ˆ M ) , as function of per-symbol squared error distortion for different download rates R for the data-driven approach (solid curves) and the compression-based scheme (dashed curves).
For MNIST a symbol is a grey-scale pixel, while for the Gaussian dataset it is a one-dimensional Gaussian RV.
As a comparison, for the Gaussian dataset, we also plot the performance of Shannon’s scheme (dotted curves), assuming β → ∞ , as outlined in Section 3.
For
Shannon’s scheme, we use the information rate , denoted by R inf and deﬁned as H ( A | Q ) /β .
It is well-known that the information rate is a true lower bound on the operational rate from (3) (cf.
Cover & Thomas (2006)).
Although R inf is a true lower bound on R , their numerical values appear to be close, e.g., for the Gaussian dataset and D = 4 .
35 , R = 2 while R inf ≈ 1 . 97 .
As expected, one can have a higher privacy level (i.e., smaller leakage) for a given distortion at the expense of a higher download rate.
For the MNIST dataset, the data-driven approach signiﬁcantly outperforms the compression-based scheme, while for the Gaussian dataset it performs close to the compression-based scheme using a variant of the generalized Lloyd’s algorithm (Lloyd, 1982; Linde et al., 1980) for the source code.
This should not come as a surprise, as for the Gaussian dataset,
[Figure]
the probabilistic model is simple and known precisely.
In particular, we believe that the generalized
Lloyd’s algorithm gives close-to-optimal values (cf.
Sabin & Gray (1986)).
For MNIST we combined
JPEG-like compression (including discrete-cosine transform), run-length encoding, and other entropy coding techniques for the compression-based scheme (cf.
Bocharova (2010, Sec. 8.2)).
However, due to a very small size of images, the constant overhead (e.g., for storing the Huffman codebook) turned out to be unacceptably high.
It is a well-known phenomenon that sophisticated compression methods work well only on ﬁles of medium and large size.
We thus opted for scalar quantization (see
Appendix D.3 for details).
Below, we also show the reconstructed digits for three levels of distortion and accuracy for a download rate of R = 1 / 2 for the MNIST dataset.
original
L =0 .
6 , D =0 .
L =0 .
5 , D =0 .
L =0 .
2 , D =0 .
So far only the download cost of the proposed schemes has been considered, neglecting both the query upload cost and the cost of distributing the trained neural networks.
First, the cost of distributing the trained networks can be neglected since training is usually done beforehand on a dedicated training server and can hence be seen as a one-time cost.
This cost vanishes as the protocol can in principle run for a very long time serving a large number of users while the dataset grows continuously.
Second, the query upload cost is in most cases much smaller than the download cost of the answers.
As we will show below, this is also the case here for MNIST.
For completeness, the one-time cost (in bits) of distributing the networks to the user is 465479 × 32 and 1259135 × 32 bits for the Gaussian and MNIST datasets, respectively, while the corresponding one-time cost of distributing the answer generation network to the server is 532230 × 32 and 7336888 × 32 bits, respectively.
[Table] [Table]
MNIST
[Table]
[Table]
(cid:1)
The number of neurons of the output layer of the query network is always equal to the number of ﬁles M .
Thus, the upload cost is at most 32 · M (assuming 32 -bits ﬂoats).
For
MNIST, this yields 32 · 10 = 320 bits, while the download cost is 28 · 28 · 1 / 2 = 392 bits (assuming R = 1 / 2 ), which is higher.
Downloading the entire dataset requires an overall communication cost of 28 · 28 · 8 · 10 =bits uncompressed, which is signiﬁcantly higher.
Moreover, the average losslessly compressed sizes for different digits range from 1351 (digit 1 ) to 1988 (digit 0 ) and leads to a total average size of 17825 bits, which is again signiﬁcantly higher than the download cost.
In general, the upload cost scales linearly with the number of ﬁles and is independent of the ﬁle size, while the download cost increases with the ﬁle size.
In general, the ﬁle size is much larger than the number of ﬁles which is the standard argument for not considering the upload cost.
In the embedded table we summarize the different costs (in bits) for both the Gaussian and MNIST datasets and compare with the cost (in bits) of downloading the entire dataset using lossless source coding.
C ONCLUSION
In this work, we have studied the tradeoff between download rate, privacy leakage to the server, and reconstruction distortion at the user for single-server IR schemes.
An IR scheme can be seen as an extension of the well-known concept of PIR by allowing for distortion in the retrieval process and relaxing the perfect privacy requirement.
An information-theoretic formulation for the tradeoff in terms of mutual information has been provided in the limit of a large ﬁle size.
We have shown that generative adversarial models can be successfully applied to design efﬁcient single-server IR schemes.
This is in particular beneﬁcial if the data statistics is unknown.
The main ingredient is a new optimization approach which combines GANs with additional constraints for the download rate and the desired reconstruction distortion at the user.
We have shown that our proposed GAN-based data-driven approach for a ﬁxed download rate is able to provide a tradeoff between distortion for the user and privacy leakage to the server, which is close to that of a proposed compression-based scheme where the source statistics is known.
A similar tradeoff as for the Gaussian case can be observed if the proposed data-driven approach is applied to a real-world dataset like MNIST, for which it signiﬁcantly outperforms the compression-based scheme.
Appendix A P ROOF OF L EMMA
Assume the schemes that achieve the triples ( R 1 , D 1 , L 1 ) and ( R 2 , D 2 , L 2 ) are C 1 and C 2 , respectively.
We denote the queries of C 1 and C 2 as Q 1 and Q 2 , respectively.
From C 1 and C 2 , we construct a new scheme C λ that achieves the triple ( λ R 1 + (1 − λ ) R 2 , λ D 1 + (1 − λ ) D 2 , λ L 1 + (1 − λ )
L 2 ) , for any λ ∈ (0 , 1) .
This is exactly the deﬁnition of a convex set.
The scheme C is as follows:
• The user generates a time-sharing RV K according to the distribution
[Equation]
• Then, the user forms the query Q =
( K, Q K )
and sends it to the server, thus explicitly notifying which of the schemes, C 1 or C 2 , is used.
• Finally, the server replies according to C K using the query Q K .
The leakage of C λ becomes
[Equation]
where equality in ( a ) can be achieved by artiﬁcially “worsening” the scheme C λ , e.g., by explicitly sending M to the server in some cases (with some probability).
The proof for the distortion and the rate of C follows in a similar manner (they are not just convex but also linear).
Hence, the set of achievable rate-distortion-leakage triples constitutes a convex set.
B P ROOF OF T HEOREM
Convexity.
We prove the convexity for R ( D , L ) based on the assumption that ρ ( P Q | M ) is convex in
P Q | M , i.e., we have
[Equation]
Note that since the queries should be generated without knowing any realizations of the retrieved ﬁles, it is quite natural to have I (cid:0) X
[ M ] ; Q (cid:1)
= 0 .
Thus, the objective function in the minimization of (6) can be expressed as
[Equation]
Now, let the distributions
P
ˆ X
[ M ] 1 , Q 1 | X [ M ] and P
ˆ X
[ M ] 2 , Q 2 | X
[ M ] achieve R ( D 1 , L 1 ) and R ( D 2 , L 2 ) , respectively.
Given P ˆ X [ M ] λ , Q λ | X [ M ] =
λP ˆ X
[ M ] 1 , Q 1 | X [ M ]
[Equation]
, Q 2 | X [ M ] for any 0 ≤ λ ≤ 1 , using the convexity of mutual information in P ˆ X
[ M ] , Q | X
[ M ] we obtain
[Equation]
Further, one can also see that P Q λ | M = λP Q 1 | M +(1 − λ ) P Q 2 | M and P
ˆ X
[ M ] λ | X [ M ] =
λP ˆ X
[ M ] 1 | X [ M ] + (1 − λ ) P ˆ X
[ M ] 2 | X [ M ] .
From the convexity of ρ ( · ) and the linearity of the distortion function d ( · , · ) , it is straightforward to see that λ L 1 + (1 − λ )
L 2 ≥ L λ and λ D 1 + (1 − λ )
D 2 ≥ D λ .
Hence, from the deﬁnition of R ( D , L ) we get
[Equation]
where ( a ) holds since the minimization is taken over a smaller constrained set, and ( b ) follows from (B.10).
This then completes the proof of convexity of R ( D , L ) .
In the following, we show that for the case of memoryless vector sources X
[ M ] , i.e., each element of X ( m ) is chosen independently and uniformly at random from F , the converse bound for the achievable rate R is indeed R ( D , L ) .
Consider an i.i.d.
sequence of length- M vectors (cid:8) X [ M ] i (cid:9) β i =1 , where X [ M ] i =
( X (1) i , X (2) i , . . .
, X ( M ) i ) , i ∈ [ β ] , and each component X ( m ) i is distributed according to P X ( m ) .
The answer encoder f n A takes the input sequence { X [ M ] i } βi =1 and the generated query Q to construct the codewords that are indexed by A = { 1 , 2 , . .
, 2 β R } .
The reconstruction decoder f n ˆX outputs an estimate { ˆ X [ M ] i } βi =1 for ˆ X [ M ] i
[Equation]
[Equation] [Equation]
) i (cid:1) using the answer A , 2 requested index
M , and the generated query Q at the user side.
A feasible scheme should satisfy
[Equation]
Hence, using the fact that the average code length over a source code is bounded from below by the entropy of the source, e.g., see Cover & Thomas (2006, Thm. 5.4.1), we have
[Equation]
− H ( A |{ X [ M ] i } βi =1 , Q ) =
I (cid:0) { X [ M ] i } βi =1 ; A (cid:12)(cid:12) Q (cid:1) ( b ) ≥ I (cid:0) {
X [ M ] i } βi =1 ; { ˆ X [ M ] i }
βi =1 (cid:12)(cid:12) Q (cid:1) ( c ) ≥ β (cid:88) i =
H (cid:0) X
[ M ] i (cid:12)(cid:12) Q (cid:1)
− β (cid:88) i =
H (cid:0) X
[ M ] i , ˆ X
[ M ] i (cid:12)(cid:12) Q (cid:1)
=
β (cid:88) i =
I (cid:16) X
[ M ] i ; ˆ X
[ M ] i (cid:12)(cid:12)(cid:12) Q (cid:17) , ( d ) ≥ β (cid:88) i =
R (cid:16) E M, Q (cid:2) d ( X ( M ) i , ˆ X ( M ) i ) (cid:3) , ρ ( P Q | M ) (cid:17) ( e ) ≥ β · R (cid:18)β β (cid:88) i =
E M, Q (cid:104) d ( X ( M ) i , ˆ X ( M ) i ) (cid:105) , ρ ( P Q | M ) (cid:19) ≥ β R ( D , L ) , where ( a ) holds since the answer A is a function of { X [ M ] i } βi =1 and Q ; ( b ) follows by the data processing inequality; ( c ) can be veriﬁed by using the chain rule of entropy and conditioning reduces entropy; ( d ) and ( e ) hold because R ( D , L ) is nonincreasing and convex.
C S OFT D ECISION D ECODING
In contrast to hard decision decoding where the server deterministically guesses exactly one M = m from the query, we can also consider a soft decision decoding rule for the server.
In this case, f ˆM ( Q ) can be seen as a distribution over [ M ] , i.e., f ˆM ( Q ) =
F ˆ M ( m | Q ) for m ∈
[ M ] , where (cid:80) m F ˆ M ( m | Q )
= 1 .
Let f Loss ( m, ˆ M ) be the log-loss function deﬁned as
[Equation]
i.e., the loss is zero when the server’s guess is equally likely.
Then, the expected loss function is equal to
[Equation]
[Equation]
where H (cid:0) P X (cid:13)(cid:13) P Y (cid:1) denotes the cross-entropy between the distributions P X and P Y , and (C.13) follows since for any two distributions P X ( · ) and P Y ( · ) , we have H (cid:0) P X ( · ) (cid:13)(cid:13) P Y ( · ) (cid:1) ≥ H (cid:0) P X ( · ) (cid:1) .
Moreover, observe that
[Equation]
and from (C.13), it follows that equality holds if P M | Q = q ( · ) =
F ˆ M ( ·| q ) .
Therefore, under the log-loss function, the leakage to the server is measured in terms of MI, i.e., ρ ( P Q | M ) =
I ( M ; Q ) , and the user wishes to minimize the MI leakage.
D A CHIEVABLE S CHEMES F ROM S ECTIOND. C OMPRESSION -B ASED S CHEME FOR G AUSSIAN D ATA
As a reference for synthetic Gaussian data (see Fig. 3(a)), we used the compression-based scheme outlined in Section 3.
As explained in Section 3, the scheme reduces to quantization of random vectors drawn from a Gaussian multinomial distribution.
We used the generalized Lloyd algorithm, also known as the Linde-Buzo-Gray (or LBG) algorithm
(Linde et al., 1980).
Note that this algorithm is closely related to k -means clustering in unsupervised learning (Levrard, 2018).
The authors argue in Linde et al.
(1980) that although their approach is not guaranteed to provide the best quantizer, its results are nearly optimal for a wide class of distributions.
We brieﬂy explain the steps of ﬁnding the quantization vectors (or levels) below and refer the interested reader to Linde et al.
(1980) for further details.
When quantizing a Gaussian vector into r bits, the number of quantization vectors is k = 2 r .
First, generate a large sample of n vectors { x i } n i =1 from the desired multinomial Gaussian distribution.
Then, select an initial set of quantization vectors { q j } k j =1 . 3.
Next, continue iterating as follows: (a) Each sample vector x
i is quantized to (approximated by) its closest quantization vector (its “nearest neighbor”)
q j ∗ i where
[Equation]
This gives a mean quantization error (or distortion) among all the sample vectors of
[Equation]
(b) Each quantization vector is updated to the mean of the sample vectors as follows:
[Equation]
where the set of sample vectors that are quantized to q j is denoted by S j (“neighborhood” of q j ).
The algorithm stops when the mean quantization error between two consecutive iterations changes less than a predeﬁned threshold.
Since the mean quantization error (or distortion) D is nonnegative and nonincreasing between iterations, the algorithm is guaranteed to converge.
Since it is a randomized algorithm, we ran it multiple times and chose the quantizer that produced the smallest mean quantization error.
As a ﬁnal remark, we remind the reader that our goal here is not to ﬁnd the best quantization possible, but only to have a good enough approximation.
Additionally, after the avhievable points are calculated, we make sure they all satisfy the convexity property (cf.
Lemma 1).
More precisely, if the triples ( R 1 , D 1 , L 1 ) , ( R 2 , D 2 , L 2 ) , and ( λ R 1 + (1 − λ ) R 2 , D 3 , λ L 1 + (1 − λ ) L 2 ) are achievable for some 0 < λ < 1 , we update
[Equation]
D. S HANNON ’ S S CHEME FOR G AUSSIAN D ATA
This section brieﬂy outlines the Shannon’s scheme for Gaussian data (plotted in Fig. 3(a)).
Following its description in Section 3, the server compresses N , N ∈
[ M ] , independent ﬁles, each consisting of β independent Gaussian RVs, together.
It is known from the rate-distortion theory for multidimensional sources Gray (1973), as the ﬁle size β → ∞ , that a download rate R = N R G ( D ) is achievable with distortion D .
Here, R G ( D ) = max { 1 2 log (cid:0) σ 2 / D (cid:1) , 0 } for a Gaussian RV distributed according to N ( µ, σ 2 ) (
Cover & Thomas, 2006, Ch. 10).
Similar to Section D.1, we further use a convexifying approach to obtain an achievable scheme for any hard decision leakage (or accuracy)/ M ≤ L ≤ 1 .
In the following we brief describe the scheme.
First, we select two accuracy values, say L 1 and L 2 , L 1 , L 2 ∈ { 1 , 1 / 2 , . .
, 1 / M } .
Applying the Gaussian rate-distortion function of R G ( D ) = 12 log (cid:0) σ 2 / D (cid:1) , D ∈ (0 , σ 2 ] , to the previously outlined scheme, one can obtain two achievable distortions
D G ( R 1 , L 1 ) =
σ 2 · 2 − 2 R 1 L 1 and D G ( R 1 , L 1 ) =
σ 2 · 2 − 2 R 2 L 2 .
Next, the desired accuracy L ∈ [ L 1 , L 2 ] is selected to be L =
λ
L 1 +(1 − λ )
L 2 , and the goal is to determine the minimum possible linear combination of D G ( R 1 , L 1 ) and D G ( R 2 , L 2 ) subject to R = λ
R 1 + (1 − λ ) R 2 , i.e.,
[Equation]
L
[Equation] [Equation]
[Equation]
This then gives the performance of the synthetic Gaussian dataset in Fig. 3(a).
As a ﬁnal remark, we also numerically evaluate the values of R ( D , L ) for the Gaussian dataset.
For instance, for D = 1 .and
L = 0 .
6 , we obtain R ( D , L )
≈ 2 .
0345 , while (D.14) gives 1 . 875 for ( R , L ) =
(2 . 0 , 0 . 6) , conﬁrming that the performance of our proposed Shannon’s scheme is optimal.
D. C OMPRESSION -B ASED S CHEME FOR THE MNIST D ATASET
The scheme is based on the ideas of Section 3 and reduces to choosing a lossy compression method for one image.
First, we applied a grayscale compression similar to the instruments used by the JPEG standard.
We refer the interested reader to (Bocharova, 2010, Sec. 8.2) for more details and other techniques for image compression.
The main ingredient of the JPEG standard is a two-dimensional discrete cosine transform.
In the standard, an image is split into 8 × 8 blocks and the transform is applied to each block independently.
Since the images from the MNIST dataset are of size 28 × 28 , we applied the transform to 7 × 7 blocks.
In this way, an image is split into 16 blocks.
Next, the resulting values were quantized by a uniform scalar quantizer.
For each block, the top-left coefﬁcients play the most important role as they grasp the low-frequency contents of the block.
Thus, they are assigned more bits from the available pool of bits (deﬁned by the desired rate).
Finally, these quantized coefﬁcients were encoded with a combination of run-length encoding and a two-dimensional Huffman code.
Since the MNIST images have a small size, the entropy coding techniques do not provide any compression beneﬁts.
For example, the usually ignored overhead of storing the Huffman coding table requires too many bits in our case.
Also, the run-length encoder performs poorly as there are not many repetitive values.
In fact, it even increases the size of an MNIST image on many occasions.
Therefore, we turned to a much simpler scalar quantization of the original grayscale images where each image is split into blocks.
For each block, the average of values of its pixels was quantized and stored.
This method also allows for easier control of the desired rate.
E L EARNING A LGORITHM FOR THE D ATA -D RIVEN A PPROACH
Input : Number of training samples n , training samples ( X [ M ], . . .
X [ M ] n ) , number of training iterations T , size of minibatch for stochastic gradient decent b , and initial tuning parameter η initial
Output : f Q , f A , f ˆX , and f ˆM 1 t ←2 η ← η initial 3 Initialize the neural networks representing f Q , f A , f ˆX , and f ˆM 4 while t ≤ T do for m ∈
[ M ] do
Generate a minibatch B m ⊆
[ n ] of indices corresponding to the m -th ﬁle, |B m |
=
b
Generate b noise samples s B m from the distribution N ( 0 , I ) for b ∈ B m do q m,b ← f Q ( m, s b ) end end
Update f
ˆM
by descending its stochastic gradient: (cid:80) M m =1 (cid:80) b ∈B m
× M log F
) for m ∈ [ M ] do
Generate a minibatch B m ⊆
[ n ] of indices corresponding to the m -th ﬁle, |B m |
=
b
Generate b noise samples s B m from the distribution N ( 0 , I )
Generate a minibatch of b training samples { X ( m ) b : b ∈ B m } for b ∈ B m do q m,b ← f Q ( m, s b ) end end for m ∈
[ M ] do for b ∈ B m do a m,b ← f A ( q m,b , X ([ M ]) b ) end end
Update f Q , f A , and f ˆX by descending its stochastic gradient: (cid:80) m
[Equation]
Update parameter
31 end
As elaborated in Section 4.1, learning is done by ﬁrst ﬁxing the download rate R and then solving the minimax optimization problem in (9).
Here, the rate is computed based on the dimension of the answer network’s output and the corresponding quantizer levels like Blau & Michaeli (2019);
Mentzer et al.
In Algorithm 1 we outline the detailed training algorithm, which is similar to Algorithm 1 in Huang et al.
The learning rate is selected empirically for each accuracy and distortion level with the RMSprop optimizer, and the number of iterations is T = 100000 .
The number of training samples, denoted by n , for the Gaussian case is set to a sufﬁciently large number (samples can easily be generated from a Gaussian RV) and to 60000 ( 6000 for each digit) for the
MNIST dataset.
The architectures of the deep neural networks representing the functions f Q , f A , f ˆX , and f ˆM used for training for the synthetic Gaussian dataset are detailed in Table 1.
In the special case of accuracy
L = 1 , i.e., full leakage, the problem reduces to the classical rate-distortion problem, and to improve performance, we only considered an encoder (for compression of the requested ﬁle), corresponding to f A , and a decoder (for decompression at the user side), corresponding to f ˆX .
Both the encoder and the decoder are represented as deep neural networks and trained in the classical way (Kingma &
Welling, 2014).
[Table]
For the MNIST dataset there are M = 10 ﬁles (there are 10 digits) and each ﬁle is of size β =
28 × 28 = 784 symbols, or 784 × 8 = 6272 bits (each picture is of size 28 × 28 pixels
and each pixel is of size 8 bits).
The architectures of the deep neural networks representing the functions f Q , f A , f ˆX , and f ˆM in this case are given in Table 2.
As for the Gaussian case, training for MNIST can be simpliﬁed for L = 1 as described above.
In order to assess the quality of the learning, we tabulate below an estimate of the inference accuracy of a MAP adversary for M , denoted by L MAP , operating directly on the queries from the query network and also an estimate of the entropy of the answer A from the answer network for the
Gaussian dataset for different levels of per-symbol squared error distortion D .
The estimates have been found by Monte-Carlo simulation of the networks, i.e., by repeatedly generating queries and answers and estimating the probability density functions of the random variables Q | M and A .
For comparison we also show the inference accuracy L of the adversary network in the third line.
As can be seen by comparing the second and third lines, the inference accuracy of the adversary network is close to the inference accuracy of a MAP adversary.
Likewise, the entropy H ( A ) is close of R · β , which gives an indication that the performance of neural networks adversary is close to an optimal bound.
For CIFAR- 10 with accuracy L = 0 . 40 and distortion D = 0 .
06 , the MAP accuracy is
L MAP
= 0 .
41 , which shows that also for CIFAR- 10 the adversary is trained quite well.
[Table]
To investigate the well-known overﬁtting problem in ML (Goodfellow et al., 2016)
[Table]
we show some learning curves with the CIFAR- 10 dataset (for leakage L = 0 .
40 , distortion D = 0 .
[Table]
and rate
R = 1 / 4 ) in Fig.
The training distortion and training adversary accuracy curves are smoothed by a uniform ﬁlter of size 100 and then sampled every 100 epoch. The testing distortion and testing [Table] [Table]
[Table]
FC [Table] [Table] FC
[Table]
FC, SeLU
FC
[Equation]
softmax adversary accuracy curves are sampled every 5000 epoch.
If overﬁtting happened, then the testing distortion would increase while the training distortion would decrease with the number of epochs.
This does not happen in our case.
In fact, the testing distortion curve is decreasing and close to the training distortion curve.
Hence, the level of overﬁtting is negligible.
Moreover, training and testing accuracy values are close.
The mode-collapse issue in GANs is well-known (Salimans et al., 2016; Goodfellow, 2017).
Modecollapse means that the generator ﬁnds some weak point of the discriminator and keeps producing this mode of output to trick the discriminator.
This may happen when the generator tries to fool the discriminator trained on a real dataset and causes problems because a GAN model is typically required to have diversity in its output.
Techniques such as minibatch discrimination (Salimans et al., [Figure] [Figure] [Figure]
2016) can be applied to prevent mode-collapse.
However, note that in our step-up mode-collapse is less relevant as we in general do not need to have diversity in the query generation.
In fact, a scheme for the MNIST dataset producing a deterministic query is a valid scheme with MAP adversary accuracy L MAP = 1 / 10 , while a scheme giving a one-to-one correspondence between M and Q | M is also valid and gives MAP adversary accuracy L MAP = 1 .
We remark that for intermediate values of the accuracy the behavior of the distribution of Q | M (for both MNIST and CIFAR- 10 ) shows no signs of mode-collapse as the number of epochs increases.