T ext M ixer: Mixing Multiple Inputs for Privacy-Preserving Inference (2023)

Abstract: Pre-trained language models (PLMs) are often deployed as cloud services, enabling users to upload textual data and perform inference remotely. However, users’ personal text often contains sensitive information, and sharing such data directly with the service providers can lead to serious privacy leakage. To address this problem, we introduce a novel privacy-preserving inference framework called , which prevents plaintext leakage during the inference phase. Inspired by k -anonymity, MixPi aims to obfuscate a user’s private input by mixing it with multiple other inputs, thereby confounding potential privacy attackers. To achieve this, our approach involves: (1) proposing a novel encryption module, Privacy Mixer, which encrypts input from three distinct dimensions: mixing, representation, and position. (2) adopting a pre-trained Multi-input Multi-output network to handle mixed representations and obtain multiple predictions. (3) employing a Privacy Demixer to ensure only the user can decrypt the real output among the multiple predictions. Furthermore, we explore different ways to automatically generate synthetic inputs required for mixing. Experimental results on token and sentence classification tasks demonstrate that MixPi greatly surpasses existing privacy-preserving methods in both performance and privacy.

## introduction the emergence of pre-trained language models (plms) @xcite @xcite has significantly increased the demand for cloud inference services. by uploading their textual inputs to the cloud, users can benefit from plms and achieve superior performance on various representations can be easily restored to plain text. our method utilizes mixing to conceal the real input among multiple inputs, thereby confusing privacy attackers and preserving the plain text privacy during inference phase. nlp tasks, without requiring high-performance hardware or expertise. however, the widespread adoption of plm services also introduces a risk of privacy leakage @xcite . users' textual inputs may contain sensitive information, including names, schedules, and even business secrets. leaking such private information to service providers is unacceptable to most users. to address users' privacy concerns and comply with relevant laws foot_0 , service providers can provide privacy-preserving inference services. many sought to make users query plm services with word representations rather than plaintext. but digital word representations still need additional privacy protection because recent studies @xcite have revealed that standard word representation can be easily restored to its original word under embedding inversion attacks @xcite . one solution is to apply cryptographic techniques to the plm @xcite @xcite , but these methods often come with significant communi-cation costs and computational time, making it difficult to apply them in real-world scenarios. another potential solution is to remove the private information in word representations @xcite through adversarial training @xcite @xcite and differential privacy @xcite @xcite . however, the private information in our scenario pertains to each word in the user's plaintext. removing the word information from word representations is highly unnatural and often leads to crucial performance degradation @xcite . in this paper, we propose a novel privacypreserving inference paradigm named textmixer. our method is inspired by k-anonymity @xcite , a classic privacy-preserving technique that ensures each individual's information cannot be distinguished from at least k-1 other individuals. for that purpose, textmixer aims to make each real word representation indistinguishable by mixing it with multiple synthetic representations during the inference phase, rather than removing word information, as shown in figure 1 . however, directly mixing the representations of k inputs leads to information interference, and normal plms cannot handle the mixed inputs to acquire the desired output. to address the above problems, we resort to multi-input multioutput (mimo) network @xcite @xcite , allows us to process mixed representations with minimal information interference and obtain multiple predictions simultaneously. we further design a privacy mixer to enhance textmixer's privacy, which encrypts the real inputs from three dimensions. for each forward pass, the privacy mixer applies anonymous mixing, representation perturbation, and position shuffling to encrypt the real inputs. only the user holds the correct keys to decrypt the real prediction from mixed representation. in this way, textmixer preserves the privacy of both the input and prediction. we also conduct an investigation into different methods for generating synthetic inputs. our contribution can be summarized as follows foot_1 : ## methodology in this section, we present a novel privacypreserving inference framework textmixer, which achieves k-anonymity @xcite by mixing multiple inputs during the inference phase. ## experimental results in this section, we show the results of privacy and task performance in §4.1 and the ablation study in §4.2. we also design three specific privacy attacks for textmixer and show the attack results in §4.3. the inference cost is shown in appendix f. ## conclusion in this paper, we propose a novel privacypreserving inference framework textmixer. our framework is inspired by k-anonymity and makes real input indistinguishable by mixing multiple inputs during the inference phase. specifically, textmixer adopts a pre-trained mimo network, which can process representation composed of multiple inputs and obtain multiple outputs simultaneously, to handle mixed representations. we further propose the privacy mixer to encrypt not only the mixing but also the two dimensions of representation and word position. we also explore various ways to automatically generate synthetic inputs. at the embedding layer, textmixer outperforms the existing privacy-preserving methods by a large margin, regardless of token and sentence classification tasks. the detailed ablation and analysis experiments also show textmixer is an effective privacy-preserving inference framework.