Shape And Structure Preserving Differential Privacy
Abstract
It is common for data structures such as images and shapes of 2D objects to be represented as points on a manifold.
The utility of a mechanism to produce sanitized differentially private estimates from such data is intimately linked to how compatible it is with the underlying structure and geometry of the space.
In particular, as recently shown, utility of the Laplace mechanism on a positively curved manifold, such as Kendall’s 2D shape space, is signiﬁcantly inﬂuenced by the curvature.
Focusing on the problem of sanitizing the Fréchet mean of a sample of points on a manifold, we exploit the characterisation of the mean as the minimizer of an objective function comprised of the sum of squared distances and develop a K-norm gradient mechanism on Riemannian manifolds that favors values that produce gradients close to the the zero of the objective function.
For the case of positively curved manifolds, we describe how using the gradient of the squared distance function offers better control over sensitivity than the Laplace mechanism, and demonstrate this numerically on a dataset of shapes of corpus callosa.
Further illustrations of the mechanism’s utility on a sphere and the manifold of symmetric positive deﬁnite matrices are also presented.
Introduction
The amount of publicly available data has increased exponentially over the past decade and alongside with it the need for data privacy has emerged.
As data gets increasingly more complex from scalar values to data on nonlinear manifolds, such as images, shapes and covariance matrices, there is a need for data privacy algorithms to adapt to the nonlinearity in, and preserve the geometric structure of, the data or parameter space.
Intuitively, when the geometry of the manifold signiﬁcantly inﬂuences sensitivity bounds through curvature-dependent terms, one would expect a structurepreserving privacy mechanism developed directly on manifolds to have better utility than its Euclidean counterpart on higher-dimensional ambient spaces within which the manifold is embedded.
This was observed in recent work on a Laplace mechanism on manifolds [Reimherr et al., 2021], and especially for manifolds with positive curvature.
Apart from spherical, or directional, data, an archetypal example of data on a positively curved manifold arises in statistical shape analysis of planar conﬁgurations representing 2D objects; the
Kendall shape space of 2D points [Kendall, 1984] modulo shape-preserving similarity transformations (e.g., rotations) is a Riemannian manifold with positive curvature.
It is evident in this setting that the utility of a privacy mechanism will depend on how well it is compatible with shape preserving transformations of the data—sanitized versions of a shape summary of a 2D image of a bird should ‘look’ like a bird, impervious to (global) rotation, scaling and translation.
Structure-preserving mechanisms within speciﬁc contexts have been considered before; see, for example Jiang et al.
[2016] concerning covariance matrices; Imtiaz and Sarwate [2018, 2016], GiladBachrach and Gonen [2017], Awan et al.
[2019], Chaudhuri et al.
[2013], Biswas et al.
[2020] for private principal component analysis; and Sheffet [2015] for private linear regression.
A general structure-preserving Laplace mechanism on manifolds was considered by Reimherr et al.
[2021], in Awan and Slavkovi´c [2021] the relationship between the data space and the sensitivity was examined in sufﬁcient generality, and a general Gaussian mechanism on Riemmanian manifolds for approximate differential privacy was considered by Han et al.
However, research on privatizing shape summaries with theoretical guarantees is conspicuous in its absence within the privacy literature; the most relevant one we have found comes from computer vision which produces random faces but offers no differentially private guarantees [Karras et al., 2019].
The two-fold motivation for our paper is to a develop a privacy mechanism for statistical shape analysis, and more generally for data on manifolds, that is compatible with the geometry of the underlying space, and further, offers better control on how the curvature inﬂuences global sensitivity bounds.
To this end, our main contributions are as follows.
We develop an extension of the K-norm Gradient Mechanism (KNG) on R d [Reimherr and Awan, 2019] for producing sanitized private estimates under the pure differential privacy framework to the setting of Riemannian manifolds, with a focus on mean estimation.
We derive a curvature-dependent upper bound on global sensitivity, which for the important case of positively curved manifolds is smaller than the corresponding one arising from a recently proposed Laplace mechanism [Reimherr et al., 2021].
Our numerical examples verify that the KNG mechanism on manifolds shares the powerful utility of its counterpart on R d , and this is is tied to the curvature of the manifold and not to the dimension of the ambient space.
We introduce the ﬁrst, to our knowledge, differentially private shape analysis under Kendall’s 2D shape space framework, and favorably compare its performance to mechanisms designed for the higher-dimensional ambient space (and not directly on the manifold) on a dataset of corpus callosa obtained from MR images.
Background
In this section we introduce the necessary tools from differential geometry and differential privacy as well as the notation for this paper.
For a thorough exposition of differential geometry and shape analysis we refer to Do Carmo [1992], Srivastava and Klassen [2016] and for DP we refer to Dwork and Roth [2014].
2.1 Differential geometry
Let M be a complete, connected Riemannian manifold of dimension d .
Denote by T m M the tangent space at each point m ∈ M and by T M = { T m M : m ∈ M} the collection of tangent spaces, known as the tangent bundle.
On the tangent space T m M at each point m , we can deﬁne an inner product (cid:104)· , ·(cid:105) m : T m M × T m M → R with induced norm (cid:107) · (cid:107) m ; the collection {(cid:104)· , ·(cid:105) m : m ∈ M} is referred to as a Riemannian metric.
The Riemannian metric varies smoothly along the manifold and allows us to measure distances, volumes, and angles.
For a curve, or path, α : [0 , 1] → M , the vector α (cid:48) ( t ) is its instantaneous velocity, and its length L ( α ) is the value (cid:82) 1 0 (cid:107) α (cid:48) ( t ) (cid:107) 1 / 2 α ( t ) d t .
A curve α is said to be arc-length parameterised if (cid:107) α (cid:48) ( t ) (cid:107) α ( t ) ≡ 1 and thus L ( α (0) , α ( t 0 ))
=
t 0 .
Geodesic curves are those with zero acceleration for all t .
The distance ρ between two points p and q is the length of the shortest path, a segment of a geodesic curve connecting the two known as the minimal geodesic: ρ ( p, q )
= inf { L ( α ) | α : [0 , 1] → M ; α (0) =
p, α (1) = q } .
Given a point p and a geodesic α with α (0) =
p , a cut point of p is deﬁned as the point α
( t 0 )
such that α is a minimal geodesic on the interval [0 , t 0 ] but fails to be for t > t 0 .
The set of all cut points of geodesics starting at p is its cut locus.
The injectivity radius of p is the distance to its cut locus, and the injectivity radius inj M of M is the inﬁmum of the injectivity radii of all points in M .
The next two tools are necessary for moving on the manifold, moving to and from the tangent spaces, and are particularly useful for sampling from distributions on manifolds.
For a geodesic α starting at p with initial velocity v , the exponential map exp( p, · ) : T p M → M : is deﬁned as exp( p, v ) =
α (1) .
From the Hopf-Rinow theorem, on a complete manifold the exponential map is surjective.
On an open ball around the origin in T p M it is a diffeomorphism onto its image outside of the cut locus of p , and a well-deﬁned inverse exp − 1 ( p, · ) :
M → T p M exists, known as the inverse exponential or logarithm map, that maps a point on M outside of the cut locus of p to T p M ; thus for any q outside of the cut locus of p , ρ ( p, q ) = (cid:107) exp − 1 ( p, q ) (cid:107) p .
There are many notions of curvature of a Riemannian manifold.
We will mainly be concerned with sectional curvature at a point p , deﬁned to be the Gaussian curvature at p of the two-dimensional surface swept out by the set of all geodesics starting at p with initial velocities lying in the twodimensional subspace of T p M spanned by two linear independent vectors.
Further, volumes of sets can be computed using the Riemannian volume form d µ .
In local coordinates, the coordinate-independent Riemannian volume form is deﬁned as (cid:112) det ( g ) d x 1 ∧ d x 2 · · · ∧ d x d , where g ij = (cid:104)
∂x
i , ∂x j (cid:105) is the Riemannian metric tensor.
A vector ﬁeld on M is a differentiable mapping M → T M that assigns to each point m on M a tangent vector in T m M .
Suppose we have a smooth function h deﬁned over M , the gradient ∇ h of h is the vector ﬁeld deﬁned by the relationship (cid:104)∇ h ( p ) , v (cid:105) p = ∂h p ( v ) for p ∈ M and v ∈ T p M .
2.2 Differential privacy
Let D = { x 1 , . . .
, x n } ⊂ M denote a dataset of size n .
In several statistical and machine learning problems, one of the most popular tools for releasing a sanitized version of a minimizer
[Equation]
of a utility function U over M is the exponential mechanism introduced by McSherry and Talwar [2007], based on a density
[Equation]
where the scale or rate parameter σ is chosen to achieve a desired level of privacy and accounts for the sensitivity of U .
If M is the Euclidean space, the density is with respect to the Lebesgue measure, and for ﬁnite or countable M , it is with respect to the counting measure.
A modiﬁcation of the exponential mechanism is the K-norm Gradient Mechanism (KNG) introduced by Reimherr and Awan [2019], which turns out to have better utility quite generally.
The idea is that the maximizer of U ( x ; D ) is also the point at which its gradient is zero.
On a Riemannian manifold
M , a KNG mechanism can be constructed using the gradient vector ﬁeld ∇ U ( x ; D ) , where the gradient is deﬁned with respect to the Riemannian metric, with the (unnormalised) density
[Equation]
deﬁned with respect to the volume measure [Reimherr et al., 2021], where (cid:107) · (cid:107) x refers to the norm with respect to Riemannian metric at x , not be confused with the subscript k as in a k -norm.
For general manifolds M , conditions on the sectional curvatures are typically needed to ensure that the density is integrable with a ﬁnite normalizing constant.
Under such conditions we can introduce a deﬁnition of differential privacy similar to that of Blum et al.
Deﬁnition 1.
For (cid:15) > 0 , a privacy mechanism satisﬁes (cid:15) -differential privacy (pure differential privacy, (cid:15) -DP) if for any pair of adjacent databases D and D (cid:48) , denoted D ∼ D (cid:48) , we have that
[Equation]
for any measurable set S ⊂ M .
To determine the rate parameter for the KNG mechanism, one needs to quantify the robustness or sensitivity, of the norm of gradient vector ﬁeld for adjacent databases.
Theorem 1.
If for all neighboring D ∼ D (cid:48) and almost all x we have
[Equation]
then one can take σ = 2∆ /(cid:15) so that the KNG mechanism will be (cid:15) -DP.
Here ∆ is referred to as the global sensitivity.
The proof of Theorem 1 follows directly from an application of the triangle inequality.
The global sensitivity ∆ plays a crucial role in determining the behavior of KNG about the optimizer of U .
Thus far, U has been a generic utility function however consideration needs to be taken for cases when U does not have a global optimizer.
Differentially private Fréchet mean estimation theory
Possibly the most fundamental summary statistic is the average or mean.
In a Euclidean setting, the mean has a closed form expression, which for general manifolds is rarely the case.
Generalizing the notion of the Euclidean mean, the Fréchet mean is deﬁned as the minimizer of the variance functional
[Equation]
where ρ is the Riemannian distance.
In general, the minimizer may not exist, and may not be unique when it does.
Study of conditions that ensure existence and uniqueness has a long history (see for e.g., Karcher [1977] and Afsari [2011]), and we thus take some necessary precautions outlined in Assumption 1.
Assumption 1.
The dataset D ⊂ B r ( p 0 ) , a geodesic ball centered at p 0 with ﬁnite radius r , with r < 12 min { inj M , π 2 κ − 1 / 2 max } and κ max > 0 is an upper bound on the sectional curvatures of M .
For non-positively curved M , κ − 1 / 2 max is interpreted as + ∞ , and Assumption 1 states that the data D must be bounded.
That is, the data can lie in a ball of any arbitrary size as long as we know how large the ball is as this directly affects the global sensitivity.
The weaker requirement r < 1 / 2 min { inj M , πκ − 1 / 2 max } sufﬁces to ensure existence and uniqueness of the Fréchet mean.
However, the stronger Assumption 1 is required to ensure that ( x, y )
(cid:55)→ ρ 2 ( x, y ) is convex along geodesics (geodesically convex) within B r ( p 0 )
Le [2001]; for example, ρ 2 is convex when restricted to a ball of radius smaller than π/ 4 on unit spheres since κ max = 1 .
For ρ 2 to be strong geodesically convex, an additional lower bound on sectional curvatures of M is required (see Lemma 1).
For mean estimation a natural utility function is U ( x ; D ) =
− F ( x ; D ) .
The KNG mechanism makes use of the gradient of U ( x ; D ) at x and hence the (Riemannian) gradient of − F ( x ; D ) , which in-turn is linked to the gradient of square-distance function x
(cid:55)→ ρ ( x i , x ) 2 for ﬁxed x i .
Under Assumption 1, each x i lies within the injectivity radius of x , and the gradient ∇ ρ ( x i , x ) 2 = − [Equation] exp − 1 ( x, x i ) .
Thus
[Equation]
The KNG mechanism then samples from the density (with respect to the volume measure)
[Equation]
to release a private statistical summary of the mean; note that when restricted to an open ball as per
Assumption 1, the density f has a ﬁnite normalising constant that depends on σ .
In Theorem 2 we provide a bound for the the global sensitivity of the KNG mechanism for mean estimation on Riemannian manifolds.
The bound is curvature-dependent in the sense that it depends on the radius r of the ball in which the data lies, the sample size n , and a function of r and κ max .
Speciﬁcally, the bound is equivalent to the bound obtained for Euclidean spaces for non-positively curved M but is inﬂated for positively curved M .
Theorem 2.
Under Assumption 1 let D = { x 1 , x 2 , . . .
, x n } and D (cid:48) =
{ x 1 , x 2 , . . .
, x (cid:48) n } be adjacent datasets .
Then
[Equation]
where
[Equation]
Proof.
For two adjacent databases D ∼ D (cid:48) that, without loss of generality, differ in the last element we have that
[Equation]
based on Jacobi ﬁeld estimates from Karcher [1977]; see also [Reimherr et al., 2021, Lemma 1].
Remark 1.
For the Laplace mechanism on M with density f ( x ; D ) ∝ e − 1 σ ρ ( x,η ) for a ﬁxed point η , whenever r is chosen as per Assumption 1, the magnitude of inﬂation of global sensitivity due to curvature was shown to be 2 r (2 − h max (2 r, κ max )) /
( nh max (2 r, κ max )) in Reimherr et al.
The upper bound obtained by the KNG mechanism is thus strictly smaller for positively curved spaces since 0 < h max (2 r, κ max ) < 1 ; in our experiments (see 4.1), this difference in sensitivity appears to result in better utility.
Although the densities for the KNG and the Laplace are not the same, they are related to the norm of a vector in T x M : when η = ¯ x , the Fréchet mean, since ρ ( x, ¯ x ) = (cid:107) exp − 1 ( x, ¯ x ) (cid:107) x , the Laplace density uses the norm of the Fréchet mean ¯ x when projected onto T x M ; on the other hand, the KNG density uses the norm of the sample mean of data { x i } when projected onto T x M .
Our next theorem shows that the utility of KNG on manifolds, as measured by the intrinsic distance ρ (˜ x, ¯ x ) matches the optimal rate of O ( d/n(cid:15) ) as in Euclidean space.
For the theorem however we require the following Lemma, proof of which is available in the Supplemental materials.
Lemma 1.
In addition to Assumption 1, assume that there exists a κ min ∈ R that lower bounds the sectional curvatures of M .
Denote by ¯ x the Fréchet mean of D .
For every x ∈ B r ( p 0 ) ,
[Equation]
max [Equation] r
[Equation]
where
[Equation]
Theorem 3.
Assume the setting of Lemma 1.
Let ˜ x denote a draw from the KNG mechanism restricted to B r ( p 0 ) , and ¯ x be the unique global optimizer of U ( x ; D ) .
We have that
[Equation]
Proof.
Recall that under Assumption 1, f ( x ; D ) =
C [Equation] U [Equation]
[Equation] x [Equation] for a ﬁnite normalizing constant C − 1 σ .
Then
[Equation]
which due to Lemma 1 results in the upper bound
[Equation]
Since r ≤ 12 inj M , there exists a unique v x ∈ exp − 1 (¯ x, ( B r ( p 0 ))
∩ B 2 r (¯ x ) such that v x = exp − 1 (¯ x, x ) , where B 2 r (¯ x )
= { v ∈ T ¯ x M : (cid:107) v (cid:107) ¯ x < 2 r } is the open ball of radius 2 r centred at the origin in T ¯ x M .
Denote by S ¯ x
the bounded subset exp − 1 (¯ x, ( B r ( p 0 )) ∩ B 2 r (¯ x ) of T ¯ x M with compact closure.
With respect to the pushforward of d µ on to T ¯ x M under the inverse exponential map at ¯ x , the ratio in (3) equals
[Equation]
The induced measure d ( µ ◦ exp(¯ x, · )) on T ¯ x M can be extended to R d by settings its value on the complement of S ¯ x to be zero.
It is then absolutely continuous with respect to the Lebesgue measure d λ on R d with a Jacobian determinant uniformly bounded above and below, respectively, by constants c 1 and c 2 on (the closure) of S ¯ x .
This ensures that the above ratio is upper bounded by
[Equation]
which, with a change of variables and using spherical coordinates, equals
[Equation]
since the curvature-dependent terms h min (2 r, κ min ) and h max (2 r, κ max ) , deﬁned in (1) and (2), are both positive and ﬁnite under Assumption 1, σ is as in Theorems 1 and 2, and the integrals in the numerator and denominator equal ( d + 1)!
and ( d − 1)! , respectively.
Examples
In this Section, we consider two simulated examples and a real data example on 2D shapes.
For the former, we consider the positively curved unit d -sphere and the set of symmetric positive deﬁnite matrices (SPDM), which when equipped with an afﬁne invariant metric is negatively curved.
Manifold valued data naturally emerges in statistical applications such as with SPDM matrices in computer vision Caseiro et al.
[2012] and brain diffusion tensor data Niethammer et al.
[2006], discrete distributions can be modeled on a sphere, in network analysis Ginestet et al. [2017] for instance, and we refer to Younes [2012], Kimmel [2003] as references with a more complete overview. In each scenario we sample from KNG via Metropolis-Hastings, a Monte Carlo Markov Chain method. This sampling method estimates our target distribution KNG and can incur a privacy loss.
That is, KNG is an instantiation of the exponential mechanism and sampling from such a mechanism via MCMC produces approximate DP samples rather than pure DP samples Shen and Yu [2013],
Wang et al.
The size of this cost is a function of the chain length, however, and decreases to zero at a geometric rate, so sampling must be done in a careful manner.
An exact sampler would be ideal, however even for some cases of well-behaved distributions sampling is not so simple Seeman et al.
This issue is a limitation of this work and we leave this as an open problem.
4.1 Spheres
Let S dκ denote the d -dimensional sphere with radius κ − 1 / 2 .
The sphere equipped with the induced metric from R d +1 , the canonical metric, has constant positive curvature κ .
The tangent space at p ∈ S dκ is then T p S dκ = { v ∈ R d +1 |(cid:104) v, p (cid:105) = 0 } .
The exponential map, deﬁned on all of T p S dκ , is given by exp( p, v ) =
cos( (cid:107) v (cid:107) ) p + κ − 1 / 2 sin( (cid:107) v (cid:107) )
v/ (cid:107) v (cid:107) and
exp( p, 0 ) = p .
The set of points at a distance at least π from p constitutes its cut locus, which then is the singleton {− p } .
With θ := ρ ( p, q ) = cos − 1 ( (cid:104) p, q (cid:105) ) , the inverse exponential map exp − 1 ( p, q ) =
θ (sin( θ )) − 1 ( q − cos( θ ) p ) at p is hence deﬁned only within the open ball around p with radius π/ (2 κ 1 / 2 ) .
Next, we consider the utility of KNG on a manifold and compare it to other sanitization techniques.
We generate random samples D from S 21 and compute the Fréchet mean ¯ x , both as described in the Supplemental material.
We set (cid:15) =
1 and sanitize ¯ x with three separate methods; ﬁrst with the proposed method KNG on manifolds to produce ˜ x KNG , second with the Laplace on manifolds as in Reimherr et al.
[2021] to produce ˜ x L , and lastly embedding ¯ x into R 3 and privatizing with the
Euclidean Laplace to produce ˜ x E .
The latter almost surely will not be on the sphere, however, since the privacy guarantees are invariant to post-processing, we project the estimate back onto the sphere by normalizing as ˜ x E → ˜ x E / (cid:107) ˜ x E (cid:107) .
We compute several such replicates at different sample sizes and display the utility comparison in the ﬁrst (left) panel of Figure 1, where the utility is measured using the average Euclidean distance (cid:107) ¯ x − ˜ x (cid:107) such that ˜ x is a the respective sanitized estimate.
We see that adding noise in the ambient space with the Euclidean Laplace adds the most noise, which may be attributed to the need to sanitize over an extra dimension.
After post-processing ˜ x E by projecting onto the sphere, the Euclidean
Laplace mechanism does have better utility than its manifold counterpart, but this is not unexpected since the sensitivity of the manifold Laplace for positively curved manifolds is inﬂated compared to the Euclidean rate of 2 r/n Reimherr et al.
Lastly, our proposed mechanism has the best utility in this comparison which may be attributed to its sensitivity being strictly less than the sensitivity of the Laplace on the manifold for positively curved manifolds.
Further, our approach will always produce a private summary which is on the manifold and does not require any post-processing.
4.2 Symmetric positive-deﬁnite matrices
Denote by P ( k ) the k ( k + 1) / 2 − dimensional manifold of k × k symmetric positive-deﬁnite matrices equipped with the afﬁne-invariant Rao-Fisher metric (cid:104) v, u (cid:105) p
=
Tr ( p − 1 up − 1 v ) , where u, v ∈ T p P ( k ) =
Sym k are symmetric matrices.
With this Riemannian metric P ( k ) has negative sectional curvature everywhere with exponential map exp( p, v ) =
p 1 / 2 Exp (cid:0) p − 1 / 2 vp − 1 / 2 (cid:1) p 1 / 2 and globally deﬁned inverse exponential map exp − 1 ( q, p ) =
q 1 / 2 Log (cid:0) q − 1 / 2 pq − 1 / 2 (cid:1)
q 1 / 2 , where Exp ( · ) and Log ( · ) are the matrix exponential and logarithm, respectively.
The distance between q and p in
P ( k ) is thus ρ ( q, p ) =
(cid:107) exp − 1 ( q, p ) (cid:107) q =
Tr [ Log ( q − 1 / 2 pq − 1 / 2 ) 2 ] 1 / 2 .
For the simulations we set k = 2 .
We generate random samples D ⊂ P ( k ) by sampling from the
Wishart distribution as discussed in the Supplemental materials.
We compute the Fréchet mean ¯ x and sanitize it with three separate approaches: (i) we generate a private mean ˜ x KNG by sanitizing on P ( k ) using the proposed approach KNG, (ii) we generate a private mean
˜ x L on P ( k ) with the
Laplace distribution as in Reimherr et al.
[2021], Hajri et al.
[2016], and (iii) we embed ¯ x into Sym k the space of symmetric matrices, represent ¯ x as a vector vech (¯ x ) ∈ R 3 , sanitize by sampling from the
Euclidean Laplace to produce vech (˜ x E ) , and lastly we revert the vectorization to obtain ˜ x E .
There is no guarantee that ˜ x E will remain in P ( k ) and further without a unique projection to P ( k ) since it is an open cone within R k ( k +1) / 2 .
Similarly to Section 4.1, in the second panel of Figure 1 we display an average utility comparison of the privatization techniques over 500 replicates with respect to the distance (cid:107) vech (¯ x ) − vech (˜ x ) (cid:107) , where ˜ x is the sanitized estimate corresponding to one of the three approaches.
We see that our approach has better utility compared to the Euclidean approach and comparable utility to the Laplace on P ( k ) .
The latter is not entirely surprising since the Laplace is equivalent to KNG for mean estimation in Euclidean space
[Reimherr and Awan, 2019].
Sampling from the Laplace on P ( k ) is fairly simple since it was thoroughly studied by Hajri et al.
[2016] and has nearly a closed form sampler; sampling from KNG on P ( k ) however is not as straightforward and we employed an
Metropolis-Hastings algorithm which may account for its inconsistent behavior compared to the
Laplace.
However, our proposed method has better utility than the Euclidean approach, which is designed on the higher-dimensional ambient space.
4.3 Kendall’s 2D shape space
Statistical shape analysis is a relatively recent ﬁeld dating back to the seminal paper by Thompson and Thompson [1942] where shapes of animals, such as ﬁsh, were shown to differ in geometric transformations such as a shear.
Since this conception there have been many branches of shape analysis that have arisen such as Kendall’s shape space [Kendall, 1984], large deformation diffeomorphic metric mapping (LDDMM)
[Grenander and Miller, 2007], and elastic shape analysis [Srivastava and
Klassen, 2016].
No matter the choice, shape analysis has demonstrated to be widely applicable in the medical ﬁeld (ERCAN et al.
[2012], Li et al.
[2014]), computer vision [Jimenez et al., 2000, Sharon and Mumford, 2006], and functional data analysis (Harris et al.
[2021], Zhang and Srivastava [2020]).
By “shape" of an object in two dimensions, we refer to the intrinsic geometric property of a set of points on the plane (representing the object) that remains unchanged under similarity transformations such as translation, rotation and scale Kendall [1984], and additionally on reparameterisations if an outline curve representation is used Srivastava and Klassen [2016].
Of the many areas of shape analysis available (for e.g., the theory of deformable templates [Trouvé and Younes, 2005] and Large deformation diffeomorphic metric mapping [Grenander and Miller, 2007]) we consider the Kendall shape space of two-dimensional landmark conﬁgurations Kendall [1984].
Consider a set x = { x j } ∈ C k of labelled k points on a 2D object, known as landmarks, in the complex plane.
If the object has been extracted from a densely sampled outline curve (for e.g., when extracted/segmented from a 2D image), then the parameterisation of the curve induces the labelling through an ordering of the points.
Labelling thus establishes a correspondence between points on different objects, and is considered to be ﬁxed.
The shape of x is what remains once translation, scaling and rotation variabilities are removed or accounted for.
Translation is removed by by transforming x → x − 1 k (cid:80) kj =1 x j resulting in a reduced space of the complex ( k − 1) − dimensional hyperplane C
= { x ∈ C k \ 0 | 1 k (cid:80) x j = 0 } .
Scaling and rotation of x amounts to multiplying by a complex number re i θ where r is the scaling factor and θ is the angle of rotation.
The shape of x then can be considered as the curve ( − π, π ] (cid:51) θ
(cid:55)→ e i θ u on the complex unit ( k − 1 )-dimensional sphere C S k − 1 in C , where u = x/ (cid:107) x (cid:107) ∈ C (or the real sphere of dimension 2 k − 3 ), (cid:107) x (cid:107) =
√ x ∗ x and x ∗ the complex conjugate of x .
The shape space is thus identiﬁed with the compact complex projective space C P k − 2 of dimension k − 2 following the scaling x → x/ (cid:107) x (cid:107) , x ∈ C .
Therefore, the geodesic shape distance between landmark conﬁgurations x and y with corresponding centred and scaled versions p and q is ρ
[Equation]
[Equation] ; thus, the injectivity radius of the shape space is π/ 2 .
Let x be a centred and scaled conﬁguration.
Minimizing unit-speed geodesics starting at x and initial velocity v in the shape space are isometrically identiﬁed with unit-speed geodesics ( − π/ 2 , π/ 2] (cid:51) s (cid:55)→ x cos( s ) + v cos sin( s ) on C S k − 1 wherein v satisﬁes v 1 k = 0 in addition to xv ∗ = 0 , and 1 k is the vector of ones[Kendall et al., 1999, Chapter 6]; such geodesics are known as ‘horizontal’ geodesics.
Consequently, the exponential map on the shape space is given by the corresponding one on the sphere with the additional condition on the velocity vectors.
The inverse exponential map at x exists within a ball of radius smaller than π/ 2 in the shape space, and is thus given by exp − 1 ( x, y )
= θ (cid:107) y −
Proj x ( y ) (cid:107) , where Proj x ( y ) :
= x ( y ∗ x ) is the projection of y onto x and θ = cos − 1 | x ∗ y | .
The (complex) holomorphic sectional curvature of the 2D Kendall’s shape space is constant and equals 4 [Kendall et al., 1999].
As an application we consider the pre-processed corpus callosum data of Cornea et al.
[2017] from the Alzheimer’s Disease Neuroimaging Initiative (ADNI).
The data are from the mid-sagittal slices of MRIs (magnetic resonance images) and we refer to Cornea et al.
[2017] on details of how the data was processed.
Their data contains 409 total corpus callosa.
The left portion of Figure 2 displayssample corpus callosa where the parameterization is visually displayed as a color gradient from blue to yellow.
In the middle we display the Fréchet mean of all 409 corpus callosa.
Having computed the mean, we then sanitize the mean with three techniques: (i) using the proposed KNG mechanism (Right: top row); (ii) for a comparison with (i), sanitize each landmark of the mean using the Laplace mechanism splitting the privacy budget (Right: middle row); (iii) sanitize each landmark as in (ii) without factoring in rotational alignment in the corpus callosum.
We expand on (ii) and (iii) in the
Supplemental material.
As we can observe in Figure 2, when one does not account for shape-preserving transformations (rotations alignment in this example), the shape of the corpus callosum is entirely destroyed during sanitization.
Sanitization over the shape manifold (Right: top row) tends to retain the structure of corpus callosum when compared with sanitizing over each coordinate (Right: middle row), which appears more distorted; for example, we observe that the shape of the ﬁfth corpus callosum (Right: middle row) has a contour with crossings.
Further, we post-process to smooth the private estimates by a ﬁrst order local linear regression.
Left panel of Figure 3 displays the post-processed KNG private estimates while the right panel shows point-wise Laplace private estimates, where rotational alignment has been carried out.
We do not post-process the private estimates which do not consider rotational alignment as they appear to be non informative.
Considering the mean shape in Figure 2, the “hook" at the top is quite prominent and comparing this to the private corpus callosa of Figurewe notice that the KNG estimates tend to preserve this structure.
Even though all the private estimates are processed in the same way, we notice the Laplace estimates are not only less smooth but can possess undesirable distortions, such as additional features such as loops.
Conclusions and future work
In this paper we demonstrate that versatility and powerful utility of the K-norm gradient mechanism on R d carries over to the manifold setting.
In particular, better control over global sensitivity when compared to the recently introduced manifold Laplace mechanism [Reimherr et al., 2021] for positively curved manifolds motivates the development of, to our knowledge, the ﬁrst privacy mechanism for statistical shape analysis of 2D point conﬁgurations.
Gains in utility when working directly on the manifold, as opposed to the higher-dimensional ambient space, are observed in the numerical examples: in terms of utility, the KNG not only outperforms the Euclidean mechanism but also the manifold Laplace mechanism.
Further, the Laplace on the manifold and our mechanism are intricately connected as they both are the exponential of a norm in a particular tangent space as we note in Remark 1; this similarity in formulation and difference in sensitivity is tied to the better utility in the case of positively curved manifolds.
Depending on the manifold, statistical utility gains enjoyed by working on the manifold can be tempered by expensive geometric computation.
For example, in the case of SPDM, the clear gains in utility are obtained within the context of computationally expensive sampling from the KNG (see also Supplemental material) owing to repeated computations of matrix inverses and square roots related to the exponential, inverse-exponential maps and the geodesic distance.
Indeed in practice, however, only a single instantiation sufﬁces.
In contrast, sampling from the Laplace on manifolds is straightforward, and there is thus room for improvement in sampling from the KNG on manifolds.
Our work represents a step in the right direction in developing privacy mechanisms for a myriad of approaches to state-of-the-art statistical shape analysis on inﬁnite-dimensional manifolds of curves and surfaces [Srivastava and Klassen, 2016], and diffeomorphisms [Grenander and Miller, 2007].
Moreover, our work opens up the possibility of developing geometry-driven privacy mechanisms for standard data analytic procedures used in various applications, such as principal component analysis (Grassmannian manifold of subspaces), rank-constrained matrix completion (quotient manifold of nonsingular matrices), and optimizing the Rayleigh quotient (Grassmannian), Procrustes problem (manifold of orthogonal matrices or frames), and pose estimation in computer vision (manifold of rotation matrices).
Acknowledgments and Disclosure of Funding
This work was funded in part by NSF SES-1853209 (to CS, MR, AS), NSF DMS-2015374 and
EPSRC EP/V048104/1 (to KB).