Driving Context into Text-to-Text Privatization (2023)

Abstract: Metric Differential Privacy enables text-to-text privatization by adding calibrated noise to the vector of a word derived from an embedding space and projecting this noisy vector back to a discrete vocabulary using a nearest neighbor search. Since words are substituted without context, this mechanism is expected to fall short at finding substitutes for words with ambiguous meanings, such as ‘bank’. To account for these ambiguous words, we leverage a sense embedding and incorporate a sense disambiguation step prior to noise injection. We encompass our modification to the privatization mechanism with an estimation of privacy and utility. For word sense disambiguation on the Words in Context dataset, we demonstrate a substantial increase in classification accuracy by 6.05%.

## introduction a tension exists between the need to leverage textual data to develop language models and privacy concerns regarding the information conveyed by that data. this is of particular importance because personal information can be recovered from language models @xcite @xcite . metric differential privacy provides a protection against the disclosure of private information. it has recently been tailored to textual analysis in the form of a text-to-text privatization mechanism @xcite . building on continuous-valued word embeddings, it relies on the assumption that words close in embedding space serve similar semantic and syntactic roles. this property of embeddings is exploited to replace all words in a text with substitute words given a probability that can be controlled by a noise parameter. a nearest neighbor search is employed to return a substitute word from all words in the embedding space. a notable deficiency of word embeddings is that they assign a single representation to each word. depending on its context, an ambiguous word can refer to multiple, potentially unrelated, meanings. word embeddings are unable to reflect this dynamic nature of words, leading to potentially inappropriate substitutions when used for text-to-text privatization. clues signaled by inappropriate substitute words may direct a classifier into the opposite direction during downstream tasks. contextualised word embeddings are an attempt at addressing this limitation by computing dynamic representations for words which can adapt based on context. however, this dynamic behavior makes it virtually impossible to return a substitute word as the nearest neighbor search requires all vectors to be pre-computed and located in the same embedding space. sense embeddings represent a middle course between lexical embeddings and contextualized embeddings. by decoupling the static representations of words into multiple representations that capture the meaning of words (covering one representation for each meaning of a word), sense representations enable context-aware text-to-text privatization. we make the following contributions: to utilize the decoupled senses of words, we further incorporate a word-sense disambiguation prior to the privatization step that discriminates a sense given a sense inventory and a context window. ## methodology aiming at context-aware privatization of ambiguous words in texts, we adopt the privatization mechanism of @xcite and replace the word embedding with a sense embedding. the sense embedding is constructed by building and clustering a graph of nearest neighbors based on vector similarities @xcite . using a context window of size 3 and minimum word frequency of 5, we construct a 300dimensional word embedding on a dump of wikipedia. we align our vocabulary with words contained in glove. our word embedding contains 95, 670 words with words vectors. for each word in the word embedding, we retrieve its 200 nearest neighbors according to the cosine similarity of their word vectors. once calculated the similarities, we build a graph of word similarities. assuming that words referring to the same sense tend to be tightly connected, while having fewer connections to words referring to different senses, word senses can be represented by a cluster of words. a sense inventory is induced from ego-network clustering. the clustering yielded 248, 218 word senses. each word sense is indexed by a sense identifier. performing graph clustering of ego-networks is non-parametric. it makes no assumptions about the number of word senses. however, the number and definition of the resulting word senses are not linked to a lexical inventory. since a word sense is assumed as a composition of words in a cluster, sense vectors are calculated as a weighted pooling of word vectors representing cluster items. in figure 1 , we depict the averaged pairwise distances of words as a function of the number of senses. on average, the distance within word senses is considerably lower than the average distance between words in the embedding space (depicted by a dotted line at 1.0550). since the privatization step is applied directly to the structure of the embedding space, the distance between senses originating from the same word must be taken into account when assessing utility and privacy. to utilize the sense representations, we incorporate a disambiguation step prior to the privatization. given a word and its context words, we map the word to a set of its sense vectors according to the sense inventory. the disambiguation strategy is based on similarity between sense and context words: argmax c•s i/∥c∥•∥s i ∥, where c is the mean of the word vectors from the context words. in line with the context size during sense induction, context words for the sense disambiguation are selected within a window of 5. this step is repeated for each word prior to the privatization step. the privatization step follows a multi-step protocol: we retrieve the sense vector for each disambiguated word. this sense vector is perturbed with noise sampled from a multivariate distribution and its noisy representation is then projected back to the discrete vocabulary space of the sense embedding. as noisy representations are unlikely to exactly represent words in the embedding space, a nearest neighbor approximation is returned. to obtain a private text of word forms, we truncate the sense identifier from the word senses. the result is a privatized text that can be post-processed by word embeddings agnostic to the sense embedding. to demonstrate the effectiveness of leveraging sense embedding in combination with a disambiguation step prior to the privatization, we privatized the ambiguous word 'bank' for a total of 500 queries and recorded its substitutions. in half of the queries, the ambiguous word is contained in a text belonging to a geographical context, and in the other half, the ambiguous word is contained in a text belonging to a financial context. the texts are 'to walk by a river bank at sunset' and to deposit money at a bank to earn interest'. we reduced the dimensionality of the substitute vectors into a two-dimensional space for visualization in figure 2 . we highlight words of the obtained substitutions. we observe that the substitution words returned by lexical privatization stem from both geographical and financial contexts. while substitutions blend between senses during lexical privatization, we discover distinct boundaries between substitute words belonging to contrasting contexts if the words are disambiguated before privatization. ## conclusion we redesigned the multivariate mechanism of metric differential privacy in the text domain to account for word meaning during privatization. we accomplished this by replacing the word embedding with a sense embedding and incorporating a sense disambiguation step prior to the noise injection. despite the congestion of the embedding space with senses that stem from the same word form, we experimentally demonstrated that our modification follows the privacy formalization of @xcite . once we recalibrated the privacy budget to ensure plausible deniability, we measured the capability of our mechanism to capture the word meaning. by calculating the similarity of pairs of words in a context that triggers the meaning of each word, we observe that the similarity score for substitutions is consistently higher when both words appear in the same context, and lower when both words appear in different contexts. with the confirmation that our mechanism captures word meaning, we were interested in whether the benefits of contextual substitutions translates into superior performance in downstream classification tasks. the results on a set of benchmark datasets demonstrated a substantial boost in generalization performance for tasks that rely on semantic reasoning rather than syntactic reasoning. limitations. our modification utilizes sense embeddings. since the senses were not mapped to an external inventory, the senses cannot be interpreted. apart from the lack of interpretability, sense embeddings are superseded by contextual embeddings derived from transformer models with sense awareness @xcite @xcite . while sense embeddings and contextual embeddings are not mutually exclusive, it is necessary to alternate between them for the purpose of privatization and optimization.