Privacy-Preserving Domain Adaptation of Semantic Parsers (2023)

Abstract: Task-oriented dialogue systems often assist users with personal or confidential matters. For this reason, the developers of such a system are generally prohibited from observing actual usage. So how can they know where the system is failing and needs more training data or new functionality? In this work, we study ways in which realistic user utterances can be generated synthetically, to help increase the linguistic and functional coverage of the system, without compromising the privacy of actual users. To this end, we propose a two-stage Differentially Private (DP) generation method which first generates latent semantic parses, and then generates utterances based on the parses. Our proposed approach improves MAUVE by 2.5X and parse tree function-type overlap by 1.3X relative to current approaches for private synthetic data generation, improving both on fluency and semantic coverage. We further validate our approach on a realistic domain adaptation task of adding new functionality from private user data to a semantic parser, and show overall gains of 8.5% points on its accuracy with the new feature.

## introduction in task-oriented dialogue systems, such as siri and alexa, a software agent parses a user's intent into a program, executes it and then communicates the results back to the user @xcite @xcite @xcite . as a result of their growing popularity, these systems face an increasing demand to improve their linguistic coverage (how do users talk?) as well as functional coverage (what are users trying to do?). an input utterance to such a system could look like this: "could you tell me what the weather is gonna be like today in new york?" and the agent answers it by predicting and executing a program, or semantic parse. in many cases, due to privacy controls, system developers can only use datasets that are limited and contrived, e.g., dialogues created by crowd workers pretending to be users. this is a significant domain shift from real private user data. unlabeled data from real user interactions with dialogue systems has abundant signals that could be used to improve the linguistic and functional coverage of semantic parsers. for instance, practitioners could detect gaps in coverage by examining interactions where the system was unsure about what to do or responded that it lacked the requested functionality. note that training on real user interactions would be problematic for privacy even if automated and unsupervised. trained models can "memorize" details of their training data @xcite @xcite , and this can be exploited through different types of attacks that either extract full training sequences from models @xcite or infer the presence of a given sequence of interest in the training data @xcite . to mitigate that problem, differentially private (dp) training algorithms, such as dp-sgd @xcite , can be used to provide worst-case guarantees on the information leakage of a trained model. this guarantee is controlled by the privacy budget ϵ, where lower epsilon means higher privacy. but while dp-sgd could be used to adapt (fine-tune) a semantic parser on unannotated private data, there is a limit to what can be done in this way. even if some users are asking the system to hop up and down, fine-tuning is unlikely to make it grow legs. thus, our goal in this paper is to use dp-sgd to produce realistic data that can be inspected (so that the developers know to build legs) and expertly annotated (to rapidly teach the semantic parser that words like "hop" and "jump" should invoke the leg api). recent concurrent work @xcite has attempted to generate synthetic labeled data to train a text classifier. they sample labels from a given distribution and sample corresponding text strings from a differentially private language model, conditioning each string on its label. this approach does not directly apply to our setting, as our distribution over labels is private and one of our goals is to learn it. we cannot even substitute a uniform distribution for the sake of generation, since no such distribution exists over the infinitely many labels of the semantic parsing task. to meet the unique requirements of our setting, a simple baseline is to ignore the classes and simply train a differentially private language model on all the private utterances, applying dp-sgd to the usual log-likelihood objective (figure 1 ). we could then sample synthetic utterances for inspection and annotation. however, we find that when we enforce privacy with budget ϵ = 3, this baseline's top-25 most common function types foot_0 only have 64% overlap with the top-25 most common function types in the private utterances (see section 5.1 and to ensure sufficient coverage of how users invoke different function types, we propose a 2-stage method (figure 2 ) that exploits the structure of the output space, by privately (using dp-sgd) modeling the parse trees (bottom of the figure ) and the conditional distribution of the utterances given a parse tree (top of the figure), separately. these models can then be used to generate as many samples as desired, by first sampling parse trees from the parse generation model and then prompting the parse2utterance model with these parse trees. using the proposed method, we observe a 80% coverage of the top-25 most common function types in private utterances, which is a significant improvement over the baseline (64%). to further evaluate the efficacy of our method in improving a downstream system, we annotate dp-generated utterances to add a missing functionality to a lowresource semantic parser, and show that the parser's accuracy on this missing functionality is 13.4% higher if the dp-generated utterances come from our 2-stage method rather than the 1-stage baseline. to train a neural network with differential privacy, the most widely used algorithm is the dp variant of stochastic gradient descent, dp-sgd @xcite . it resembles ordinary sgd, but at each gradient update step, it first clips the per-example gradient to a maximum norm of c, then obfuscates it by adding gaussian noise with mean 0 and standard deviation σc. intuitively, this limits the contribution that any single example makes to the final model parameters returned by the training algorithm a. the privacy expenditure of dp-sgd, (ϵ,δ), is a function of c, σ, |b| (batch size), |d| (dataset size), and the total number of epochs t (which controls the total number of gradient updates). it is determined based on the rényi dp @xcite privacy accounting method. in practice, following prior work, we fine-tune our models using dp-adam @xcite @xcite . we elaborate more on dp training in appendix c. post-processing property. this property of dp ensures that if an algorithm a satisfies (ϵ,δ)-dp, then so does f • a for any function f @xcite . this means that we can take as many samples as we want from the dp-trained models, without changing the privacy expenditure. ## experimental setup in this section we briefly describe our experimental setup. for full experimental details see app. a. ## related work we offer a brief summary of related work here. for a detailed discussion see appendix d. pii scrubbing. techniques such as automated removal of personally identifiable information (pii) @xcite and training with redacted data @xcite are often used to protect user privacy, especially in 8 medical settings @xcite . however, alone, they do not provide stringent guarantees or bounds on information leakage @xcite , as there are many forms of private information not captured in pii removal. rather, dp is used as a gold standard for limiting leakage. differentially private data synthesis. recent concurrent work @xcite has attempted different variations of taking samples from a dp-trained model @xcite @xcite @xcite @xcite to synthesize labeled data for classification tasks, by conditioning the generation on the label of each sample, and assuming that the prior distribution over labels is known and public. they then use this data to augment and improve classification models. in our case, however, we are not dealing with finite labels or classification, we want to improve the performance of a semantic parser, which is a structured (hierarchical) task, where there are infinite possible parses that we cannot enumerate, and the labels are also private (since parse trees are almost unique we consider them private). therefore, existing methods cannot be applied to this problem, as mentioned in the introduction. another difference in this concurrent line of work is their reliance on gold (ground truth) labels. in our case, as we show in the final experiment, we can instead train our dp models on imperfect parse trees that are generated by low-resource parsers. semantic parsing. the closest work to ours is @xcite , which deals with the problem of safely learning from private user utterances, starting with a low-resource semantic parser. unlike our setup, however, they do not rely on dp and are only concerned with the removal of pii. while they also consider a distribution over parse trees and employ a parse-tree-to-utterance process, they implement the latter using only the original supervised data, which forecloses the possibility of adapting to distributional shifts as in our experiments. another line of work advocates for attenuating privacy risks by enabling semantic parsers to autonomously learn from interacting with users @xcite @xcite . through privacy-preserving data synthesis, our method supports diagnostics of private user traffic and better control over the associated learning process. @xcite propose data generation methods designed for the "intents and slots" model where each utterance is considered to have one of a fixed set of intents, and each intent has a fixed set of slots, each of which needs to be filled with a value. we, in contrast, use the smcalflow and treedst datasets which use compositional semantic representations of arbitrary complexity. @xcite and @xcite propose to use automated paraphrasing to create semantically equivalent variants of an existing utterance. each utterance is paraphrased independently of the others. unfortunately, paraphrases of a private utterance cannot be made public as they leak information about the private utterance; obtaining differentially private paraphrases would require new research. training the paraphrasing model by dp-sgd will not help (and is generally unnecessary as such a model can be trained on public data). ## conclusions in this paper, we studied the problem of using private user data to improve semantic parser performance in task-oriented dialogue systems, without violating user privacy. we proposed a two-stage method for differentially private utterance synthesis that exploits the inherent structure in the parse trees to better fit the private distribution. we showed that this method outperforms a baseline dp generative language model on a variety of datasets and metrics. we also demonstrated the effectiveness of our method in an end-to-end application scenario where we improved the performance of a low-resource parser by adding new functionality that was motivated by private user data. we showed that our method provided overall gains of 8.5% points in accuracy with the new feature.