Reasoning over Public and Private Data in Retrieval-Based Systems (2023)

Abstract: Users an organizations are generating ever-increasing amounts of private data from a wide range of sources. Incorporating private context is important to personalize open-domain tasks such as question-answering, fact-checking, and personal assistants. State-of-the-art systems for these tasks explicitly retrieve information that is relevant to an input question from a background corpus before producing an answer. While today’s retrieval systems assume relevant corpora are fully (e.g., publicly) accessible, users are often unable or unwilling to expose their private data to entities hosting public data. We define the Split Iterative Retrieval (SPIRAL) problem involving iterative retrieval over multiple privacy scopes. We introduce a foundational benchmark with which to study SPIRAL, as no existing benchmark includes data from a private distribution. Our dataset, ConcurrentQA, includes data from distinct public and private distributions and is the first textual QA benchmark requiring concurrent retrieval over multiple distributions. Finally, we show that existing retrieval approaches face significant performance degradations when applied to our proposed retrieval setting and investigate approaches with which these tradeoffs can be mitigated. We release the new benchmark and code to reproduce the results.1

## introduction the world's information is split between publicly and privately accessible scopes, and the ability to simultaneously reason over both scopes is useful to support personalized tasks. however, retrievalbased machine learning (ml) systems, which first retrieve relevant information to a user input from background knowledge sources before providing an output, do not consider retrieving from private data that organizations and individuals aggregate locally. neural retrieval systems are achieving impressive performance across applications such as language-modeling @xcite , question answering @xcite , and dialogue @xcite , and we focus on the under-explored question of how to personalize these systems while preserving privacy. consider the following examples that require retrieving information from both public and private scopes. individuals could ask ''with my gpa and sat score, which universities should i apply to?'' or ''is my blood pressure in the normal range for someone 55+?''. in an organization, an ml engineer could ask: ''how do i fine-tune a language model, based on public stackoverflow and our internal company documentation?'', or a doctor could ask ''how are covid-19 vaccinations affecting patients with type-1 diabetes based on our private hospital records and public pubmed reports?''. to answer such questions, users manually cross-reference public and private information sources. we initiate the study of a retrieval setting that enables using public (global) data to enhance our understanding of private (local) data. modern retrieval systems typically collect documents that are most similar to a user's question from a massive corpus, and provide the resulting documents to a separate model, which reasons over the information to output an answer @xcite . multi-hop reasoning @xcite can be used to answer complex queries over information distributed across multiple documents, e.g., news articles and wikipedia. for such queries, we observe that using multiple rounds of retrieval (i.e., combining the original query with retrieved documents at round i for use in retrieval at round i + 1) provides over 75% improvement in quality versus using one round of retrieval (section 5). iterative retrieval is now common in retrieval @xcite @xcite @xcite . existing multi-hop systems perform retrieval over a single privacy scope. however, users and organizations often cannot expose data to public entities. maintaining terabyte-scale and dynamic data is difficult for many private entities, warranting retrieval from multiple distributed corpora. to understand why distributed multi-hop retrieval implicates privacy concerns, consider two illustrative questions an employee may ask. first, to answer ''of the products our competitors released this month, which are similar to our unreleased upcoming products?'', an existing multihop system likely (1) retrieves public documents (e.g., news articles) about competitors, and (2) uses these to find private documents (e.g., company emails) about internal products, leaking no private information. meanwhile, ''have any companies ever released similar products to the one we are designing?'' entails (1) retrieving private documents detailing the upcoming product, and (2) performing similarity search for public products using information from the confidential documents. the latter reveals private data to an untrusted entity hosting a public corpus. an effective privacy model will minimize leakage. we introduce the split iterative retrieval (spiral) problem. public and private document distributions usually differ and our first observation is that all existing textual benchmarks require retrieving from one data-distribution. to appropriately evaluate spiral, we create the first textual multi-distribution benchmark, con-currentqa, which spans wikipedia in the public domain and emails in the private domain, enabling the study of two novel real-world retrieval setups: in summary: (1) we are the first to report on problems with applying existing neural retrieval systems to the public and private retrieval setting, (2) we create concurrentqa, the first textual multi-distribution benchmark to study the problems, and (3) we provide extensive evaluations of existing retrieval approaches under the proposed real-world retrieval settings. we hope this work encourages further research on private retrieval. ## concurrentqa benchmark here we develop a testbed for studying publicprivate retrieval. we require questions spanning two corpora, d p and d g . first, we consider using existing benchmarks and describe the limitations we encounter, motivating the creation of our new benchmark, concurrentqa. then we describe the dataset collection process and its contents. ## evaluating mixed-domain retrieval here we study the sota multi-hop model performance on concurrentqa in the novel multidistribution setting. the ability for models trained on public data to generalize to private distributions, with little or no labeled data, is a precursor to solutions for spiral. in the commonly studied zero-shot retrieval setting @xcite , the top k of k passages will be from a single distribution, however users often have diverse questions and documents. we first evaluate multi-hop retrievers. then we apply strong single-hop retrievers to the setting, to understand the degree to which iterative retrieval is required in concurrentqa. ## evaluation under privacy constraints this section provides baselines for concurrent-qa under privacy constraints. we concretely study a baseline in which no private information is revealed publicly whatsoever. we believe this is an informative baseline for two reasons: setup we use models trained on wikipedia data to evaluate performance under privacy restrictions both in the in-distribution multi-hop hotpotqa-spiral (an adaptation of the hotpot-qa benchmark to the spiral setting @xcite ) and multi-distribution concurrentqa settings. motivating the latter setup, sufficient training data is seldom available for all private distributions. we use the multi-hop sota model, mdr, which is representative of the iterative retrieval procedure that is used across multi-hop solutions @xcite @xcite . we construct hotpot-spiral by randomly assigning passages to the private (d p ) and public (d g ) corpora. to enable a clear comparison, we ensure that the sizes of d p and d g , and the proportions of questions for which the gold documents are public and private in hop 1 and hop 2 match those in concurrentqa. ## conclusion we ask how to personalize neural retrievalsystems in a privacy-preserving way and report on how arbitrary retrieval over public and pri-vate data poses a privacy concern. we define the spiral retrieval problem, present the first textual multi-distribution benchmark to study the novel setting, and empirically characterize the privacy-quality tradeoffs faced by neural retrieval systems. we motivated the creation of a new benchmark, as opposed to repurposing existing benchmarks through our analysis. we qualitatively identified differences between the public wikipedia and private emails in section 4.3, and quantitatively demonstrated the effects of applying models trained on one distribution (e.g., public) to the mixeddistribution (e.g., public and private) setting in sections 5 and 6. private iterative retrieval is underexplored and we hope the benchmark-resource and evaluations we provide inspire further research on this topic, for instance under alternate privacy models. k avg-pr f1 @xmath0.4 33.5 @xmath1.9 44.7 @xmath2.3 48.0 @xmath3.4 50.4 @xmath4.8 53.0 we consider different values of @xmath7, 10, 25, 100} per retrieval, reported in