Privacy-Preserving Knowledge Transfer through Partial Parameter Sharing (2023)

Abstract: Valuable datasets that contain sensitive information are not shared due to privacy and copyright concerns. This hinders progress in many areas and prevents the use of machine learning solutions to solve relevant tasks. One possible solution is sharing models that are trained on such datasets. However, this is also associated with potential privacy risks due to data extraction attacks. In this work, we propose a solution based on sharing parts of the model’s parameters, and using a proxy dataset for complimentary knowledge transfer. Our experiments show encouraging results, and reduced risk to potential training data identification attacks. We present a viable solution to sharing knowledge with data-disadvantaged parties, that do not have the resources to produce high-quality data, with reduced privacy risks to the sharing parties. We make our code publicly available.

## introduction nlp research in many areas (e.g., healthcare) is hindered by the unavailability of publicly-available datasets. even though such datasets might be available for some researchers, sharing them with the community is problematic in many cases due to privacy and copyright concerns @xcite . de-identifying sensitive information in such datasets is a potential option. however, depending on the nature of the data, the utility of the data might be negatively affected @xcite when de-identifying the data. sharing a model that is trained on the data instead of directly sharing the data itself is another option @xcite . the shared model transfers knowledge gained from raw data and is beneficial in many cases (e.g., when an institute is interested in solving the same task, but lacks enough data). however, sharing the model is also associated with potential re-identification risks @xcite . instead of directly sharing models or data, datafree knowledge distillation (df-kd) aims to transfer the knowledge from a large teacher model to a smaller student model without relying on any task-specific data, i.e., data that has been used to train the teacher model. instead, many approaches make use of a proxy dataset @xcite to facilitate the knowledge transfer. in this work, we propose a solution to the problem of sharing knowledge between models in a privacy-preserving manner. our solution depends on sharing parts of the model, and using a proxy dataset for complementary knowledge transfer. partially sharing the model mitigates potential privacy risks. further training on a proxy dataset helps compensating the loss caused by the absence of the non-shared parts of the model. we experiment on two datasets for text classification from the clinical domain, ap @xcite for relation classification and mednli @xcite for natural language inference, and show that our approach substantially improves the performance of a student model trained only on a proxy dataset. additionally, we show that the resulting model cannot be leveraged to reliably identify the original training data. teacher student mednli ap labels mednli with frozen, teacher model is used only for inference training on data from mednli with ap labels 2 related work knowledge distillation (kd). the goal of knowledge distillation is to transfer knowledge from a large teacher model to a student model of a smaller size. @xcite propose training the student model such, that its output distribution matches the output distribution of the teacher. in order to distill knowledge from bert @xcite into a smaller transformer architecture, @xcite additionally use the masked language modeling loss used to pre-train bert and a cosine embedding loss in order to make the hidden representations from both models more similar on the original pre-trainig corpus of bert. haidar et al. data extraction from language models. carlini et al. @xcite show that it is possible to extract training data from gpt-2 @xcite . @xcite experiment on gpt-neo @xcite and show that it could leak sensitive information, but the chances of extracting information about a specific user are small because of the model's weak association abilities. similar work that targets bert @xcite suggests that extracting sensitive information from bert is unlikely, but robustness against more sophisticated attacks cannot be guaranteed. membership inference attacks, that aim to identify whether certain data instances have been used to train the model, show some success against bert @xcite . we conduct a membership inference attack, in order to inspect if the student models we produce can be used to identify the teacher's training examples. ## problem statement let t be a teacher model, trained for a specific task target on training data d target and s be a student model with the same architecture, but untrained. we are interested in transferring the knowledge captured by t on d target to s without providing s any access to d target . ideally, s cannot be used to identify any data from target. s can be trained on any data that does not come from the same distribution as d target . we refer to such data as d proxy . t can provide predictions on d proxy based on what it has learned on d target . we measure the performance of both, t and s, using a held-out test set from target, which we refer to as d ′ target . ## method our method for transferring knowledge from t to s without using any task-specific data, consists of two parts: 1) partial parameter sharing, 2) finetuning on a proxy dataset. partial parameter sharing. since t and s have the same architecture, we copy parameters from n non-adjacent layers of t , and use them directly in the corresponding position in s, in order to facilitate knowledge transfer from t to s. we consider sharing only non-adjacent layers from t , since having several consecutive layers in their initialized state might result in representations of lower quality. we keep the parameters from t fixed during the later finetuning step to avoid degrading to parameters of lower quality. since the parameters from t reflect a compressed version of the data, we conjecture that partially sharing them provides s only with a distorted and partial view of d target . finetuning on a proxy dataset. sharing parameters in the first step only affects n layers from s, the rest of the layers in s are kept in their state from pre-training, and the task-specific parameters are randomly initialized. in order to make these layers contribute to the knowledge transfer as well, we finetune the model using the proxy dataset d proxy . note that d proxy contains data that are not part of target, but that are artificially labeled using t . hence, d proxy can be unlabeled. this process is depicted in figure 1 . we only use hard predictions from t , i.e., we only use the class with the highest probability as label and do not use t 's probability distribution over all classes. we leave experimenting with t 's probability distribution over all classes for future work. to train the student model, we use the cross-entropy loss: ## experimental setup in this section, we describe the data and the experiments we design to evaluate our proposed method for knowledge transfer. ## results and discussion the results for the experiments explained in sections 5.2 and 5.3 are shown in ## conclusion in this work, we presented an approach to tackle knowledge transfer between two parties: a teacher, that is trained on sensitive data, and a student model, that lacks enough data to be trained, but is interested in learning the same task. our solution depends on the teacher partially sharing some of its parameters with the student, and providing it with predictions on an unlabeled proxy dataset that is different from the target dataset. our experimental results indicate that the proposed solution is effective in knowledge transfer, and associated with reduced risks to potential training data identification attacks. in future work, we will look into using other model architectures, use more tasks for evaluation, take into account more advanced privacy attacks and consider cross-lingual settings, where the teacher and student use different languages.