T ext O bfuscator: Making Pre-trained Language Model a Privacy Protector via Obfuscating Word Representations (2023)

Abstract: In real-world applications, pre-trained language models are typically deployed on the cloud, allowing clients to upload data and perform compute-intensive inference remotely. To avoid sharing sensitive data directly with service providers, clients can upload numerical representations rather than plain text to the cloud. However, recent text reconstruction techniques have demonstrated that it is possible to transform representations into original words, suggesting that privacy risk remains. In this paper, we propose TextObfuscator, a novel framework for protecting inference privacy by applying random perturbations to clustered representations. The random perturbations make the representations indistinguishable from surrounding clustered representations, thus obscuring word information while retaining the original word functionality. To achieve this, we utilize prototypes to learn clustered representation, where tokens of similar functionality are encouraged to be closer to the same prototype during training. Additionally, we design different methods to find prototypes for token-level and sentence-level tasks, which can improve performance by incorporating semantic and task information. Experimental results on token and sentence classification tasks show that TextObfuscator achieves improvement over compared methods without increasing inference cost.

## introduction pre-trained language models (plms) have achieved impressive performance on various nlp downstream tasks @xcite figure 1 : illustration of the inference services and privacy risks. although clients upload word representations instead of plain text to the cloud server, privacy attackers can still transform representations into original texts. clients are still at privacy risk. 2020; @xcite ), but they also come with increased model size and significant computational requirements. in real-world applications, these large-scale models are often offered as an inference service @xcite . the service providers train plms for target tasks and deploy them on the cloud. clients who lack high-computation resources can query these service with their input and obtains the desired responses @xcite . unfortunately, current inference services are plagued by serious privacy concerns @xcite . client data may contain sensitive information such as names, addresses, and even trade secrets, sharing such information with service providers compromises the privacy of clients. to address privacy risks, a naive solution is for clients to generate shallow representations on their devices and upload numerical representations to the cloud for subsequent inference, as shown in figure 1 . however, recent text reconstruction methods @xcite have shown that word representations can be easily transformed into raw texts, indicating privacy risk remains. inference service without privacy guarantees is not only unacceptable for clients but also illegal for service providers 1 . recent literature has proposed various methods to mitigate privacy leakage in representation. for example, @xcite and @xcite have applied homomorphic encryption @xcite to transformer-based models, which enables computations to be performed on encrypted data. but homomorphic encryption often incurs significant computation time and communication costs @xcite , making it impractical for real-world applications. alternatively, several studies have adapted differential privacy @xcite @xcite and adversarial training @xcite @xcite to reduce the privacy information contained in representations. however, in our scenario, the privacy information pertains to each word, and reducing word information in the shallow layer can harm subsequent inference, thus degrading performance @xcite , especially in token-level tasks. in this paper, we propose textobfuscator, a novel paradigm for privacy-preserving inference. the key idea of our method is to learn private representations that obscure original word information while preserving original word functionality. specifically, we find prototypes for each word and encourage functionally similar words close to the same prototype during training. subsequently, random perturbations are applied to these clustered representations, which yields two key benefits. firstly, it obscures original word information as the perturbed representations are indistinguishable from those clustered around them, making it harder for privacy attackers to reconstruct original words, thus protecting privacy. secondly, it maintains the original word functionality as the perturbed representations stay within the same functional clusters, leading to improved performance. to learn clustered representations, we have designed different methods to find suitable prototypes for token and sentence classification. for tokenlevel tasks, each word is assigned a label that serves as a prototype indicator @xcite . but for sentence-level tasks, there is no explicit prototype indicator for words. therefore, the clustering algorithm is used for word assignment. based on clustering results, we take the cluster centers as prototypes and assign semantically similar words to the same prototype. however, semantic-based clustering may lead to keywords from different classes being clustered together, hindering target tasks. for example, if "good" and "bad" play the same role, the sentiment of a sentence will be ambiguous. to address this, we utilize tf-idf to identify keywords from different classes and use these keywords to redivide the clustering results. our codes are publicly available at https://github.com/ xzhou20/textobfuscator . our contribution can be summarized as follows: ## related work the high performance and computational cost of plms have accelerated the development of inference services @xcite . these services enable clients to perform compute-intensive plm inference in the cloud by uploading personal data, which brings convenience but also raises concerns about privacy @xcite . in order to mitigate privacy leakage, many sought to upload representations that have been privatized by privacy-preserving technologies instead of the original text to the cloud @xcite . one method is to encrypt the representation, using either homomorphic encryption @xcite or a customized encryption protocol @xcite to enable computations to be performed on the encrypted representation. encryption-based methods often require high computation time and communication costs @xcite and may not be practical for real-world applications. therefore, we did not compare this method in our experiments. another method is to use differential privacy @xcite @xcite and adversarial training @xcite @xcite to learn private representation, which reduces privacy attributes in representation. applying these works to reduce word information leads to limited performance, as the word information in the shallow layer is important for subsequent inference. our method proposes to obfuscate word information while maintaining word functionality, thus providing better performance and privacy. recently, @xcite propose textfusion, which utilizes token fusion to hinder privacy attackers from training a targeted inversion model. we explore a stronger and more realistic setting than textfusion, where the privacy attacker is the service provider itself. as the service provider is aware of textfusion's defense strategies, they can design targeted privacy attack methods to disclose more sensitive information. we did not compare our method with textfusion due to different settings. in addition to nlp, there are also many works for protecting inference privacy in computer vision @xcite @xcite , however, most of these methods cannot be used directly in nlp because they only consider one single image, and we need to protect the privacy of a sequence of words. the popularity of transformer structures @xcite in computer vision may alleviate this situation, but the adaptation of these methods still requires further exploration. ## conclusion in this paper, we propose textobfuscator, a novel representation learning method for privacypreserving inference. the main idea of our method is to obfuscate word information and maintain word functionality. we achieve this by applying random perturbations to the clustered representations. the perturbed representations are indistinguishable from the surrounding representations but still around their functional clusters. to learn clustered representation, we find prototypes for each word and encourage the word representation to be close to its prototype. additionally, we propose different methods to find prototypes for token-level and sentence-level tasks, utilizing semantic and task information. through experiments on token and sentence classification tasks, we evaluate the effectiveness of textobfuscator and provide further analysis of the principles of our proposed method. overall, our results suggest that textobfuscator is a promising method for preserving inference privacy.