A Privacy-Preserving Approach to Extraction of Personal Information through Automatic Annotation and Federated Learning (2021)

Abstract: We curated WikiPII, an automatically labeled dataset composed of Wikipedia biography pages, annotated for personal information extraction. Although automatic annotation can lead to a high degree of label noise, it is an inexpensive process and can generate large volumes of annotated documents. We trained a BERT-based NER model with WikiPII and showed that with an adequately large training dataset, the model can significantly decrease the cost of manual information extraction, despite the high level of label noise. In a similar approach, organizations can leverage text mining techniques to create customized annotated datasets from their historical data without sharing the raw data for human annotation. Also, we explore collaborative training of NER models through federated learning when the annotation is noisy. Our results suggest that depending on the level of trust to the ML operator and the volume of the available data, distributed training can be an effective way of training a personal information identifier in a privacy-preserved manner. Research material is available at https://github.com/ratmcu/wikipiifed .

## introduction extraction of personally identifiable information (pii) from unstructured text is a crucial task in many industries such as healthcare (e.g @xcite ) legal documents @xcite , mining of user-generated data @xcite and publication process @xcite . pii is a laborious task, often necessary for de-identification purposes, among other applications. for example, the extracted information can be used for indexing of documents, categorization and other applications. identification of pii elements is a laborious task that can be automated by deploying named entity recognition (ner) models @xcite . we formulate pii recognition as a ner task that extracts predefined pii entities. our goal is to develop ner models to decrease this task's * equal contribution. ## wikipii dataset our goal is to create and annotate a customized textual dataset for training a pii extractor (the scenario described in section 1). approaches like snorkel @xcite had been embracing noise of automatic annotations and compensated the noise by adding to the volume of inexpensive data. we took the same approach for annotating wikipedia pages and benefited from the fact that a version of entities was available in the infobox. we used the infobox to generate noisy and inexpensive data annotations, whereas snorkel uses multiple noisy parallel annotation functions and weak-supervision from alternative sources. we collected our data from wikipedia biography pages because 1) they are rich in terms of pii, 2) with the infobox available on each page, they comply with our assumption of having access to extracted pii, 3) they are publicly available and can be shared and used as a benchmark for research purposes. similar automated annotation tasks such as @xcite utilized a broader set of wikipedia pages and contain general conll style (sang and de meulder, 2003) (location, organization, person, miscellaneous) classes of entities and does not focus on granular personal information as ours. we refer to this dataset as wikipii and release this data for further research. ## evaluation of pii extraction averaged f-score is a common metric to evaluate a ner system. however, the definition of a true positive and a true negative prediction is not always trivial. since identifying an entity involves finding both the span and type of the entity, some of the system's predictions can be partially correct. multiple evaluation schemes have been developed. shared tasks such as irex @xcite , and conll (sang and de meulder, 2003) only gave credit to the exacted entities with the exact type and boundary matches. other works have adopted type matching or partial matching evaluation schemes, which reward partially correct entity extractions @xcite @xcite . learningbased evaluation methods are developed to predict the user experience in specific tasks @xcite . pii extraction is a sensitive task, and a fully automatic system cannot be reliable. instead, the output of such systems are used to augment the performance of manual pii extraction. in practice, when a human is in the loop, partial matching can reduce the manual effort of pii extraction. we adopted the metrics introduced by the muc-5 task (chinchor and sundheim, 1993), and semeval-13 task 9 (segura bedmar et al., 2013) and implemented the following evaluation metrics ordered in terms of strictness: ## pii extraction model first, we evaluate the automated annotation compared to the manual annotation. then we use the automatically annotated train set to train a bertbased ner model with a fully connected linear layer as the prediction layer. we then evaluate the performance of the trained pii recognizer on both automatically and manually annotated test sets. ## distributed training modern deep learning models are known as datahungry algorithms. in the task of pii extraction, sharing data across organizations will lead to more robust models. however, sharing of personal data in a central location involves concerns of privacy. to mitigate the risk of data breaches, we can train machine learning models in a distributed fashion while leaving the data in a location governed by the data owners. in this work, we explore federated learning (fl) @xcite for training a ner model with noisy labelled data. federated learning involves training statistical models over remote data centers, such as mobile phones or hospitals, while keeping data localized without requiring transfer of the whole dataset to a central location. to implement fl, we use the pysyft framework, developed by openmined foot_4 . this framework is developed in pytorch and provides the platform for executing tensor operations remotely @xcite . pysyft has been developed under the theme "answer questions you cannot see", to perform machine learning inference with zero knowledge about the specifics of the data. in this framework, a central entity orchestrates the training scenario. data is maintained and tagged by its owners at a remote location. at each data location, a worker follows the commands of the central entity. the model is transferred to the remote location, and updates are completed remotely at each training iteration. subsequently, the final model is updated by averaging weights, averaging remote gradient updates or consecutive updates at each dataset location @xcite . ## discussion in this work, our goal is to use the historical data accumulated in an organization to build a customized ner for a human-in-the-loop pii recognition tool. we expect that this tool can significantly decrease the cost of manual extraction by locating pii entities in the free text. first, we assume that the organization has access to a corpus of unstructured documents along with the structured dataset containing their corresponding pii entities. we propose that these parallel datasets can be used to create a noisy annotated training set. our method of automatic annotation is based on matching of phrases and the raw data is not exposed to a third party for annotation. using wikipedia biography pages as an example, we show the feasibility of creating a noisy annotated dataset and training a pii recognition model in a privacy-preserved fashion. our automatic annotation is inexpensive. therefore it can generate large volumes of annotated datasets to compensate for the label noise. this is in line with previous work showing that deep learning is robust against noise when trained with massive noisy datasets @xcite . furthermore, we looked at the feasibility of distributed training in cases that multiple organizations have similar datasets and are willing to collaborate to build more robust models but cannot share the data due to privacy concerns. we showed that where the operator is trusted, distributed training will not affect performance regardless of the annotation quality. for both conll2003 (clean annotations) and our wikipii dataset (noisy annotations), the f-score of ner models does not suffer from distributed training. however, when the operator is not trusted, the f-score is impacted and the drop of f-score is more significant in the case of the noisy dataset. in model transfer, all the parameter tensors of the model go through the simplification, serialization and compression steps followed by decompression, de-serialization and decompression steps. we suspect this mechanism affects the precision of the weights. in future work, a rigorous analysis should be carried out to analyze the effect of object transfers in a distributed system. lastly, in the federated/central scenario, we showed that the increase in the dataset size is a promising way to achieve higher accuracies. distributed training allows organizations to share their data which results in a bigger size of the data. we conclude that there is a trade-off between the drop in performance because of the distributed training and the increase in performance because of the higher volume of data. this work has limitations. ner is a very challenging task, and it is difficult to achieve a fully reliable ner model for a sensitive task such as pii extraction. also, even highly accurate ner models can be vulnerable to adversarial attacks @xcite . for this reason, throughout this work, we only envisioned this system to assist human annotators by locating the entities and suggest a highly likely tag. although this system does not reach very high performance, it is still instrumental in reducing the cost of pii extraction when compared to a fully manual procedure. we only considered a bert-based ner model, but the general idea applies to other transformer-based ner models. in future, an ensemble of different techniques should be considered to improve the utility of the system. ## conclusion we propose an inexpensive and privacy-preserved method that automatically annotates parallel structured/unstructured datasets to train a customized ner models. the final models can be used to decrease the cost of manual extraction of pii elements by preprocessing the documents in a human-in-theloop setting. our results demonstrate that federated training is a promising tool to compensate for label noise by increasing the volume of the noisy labeled dataset.