Investigating Statistical Privacy Frameworks from the Perspective of Hypothesis Testing

Liu, Changchang; He, Xi; Chanyaswad, Thee; Wang, Shiqiang; Mittal, Prateek

doi:10.2478/popets-2019-0045

Cited by 26 publications

(25 citation statements)

References 52 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Privacy leakage attacks: it was understood that adversary of Differential Privacy seek to determine whether the observed outcome is due to one of two neighboring datasets differing by a single data point. While this hypothesis testing interpretation of Differential Privacy was elucidated in [29,19,21,2,3], it is limited by the neighboring datasets assumption and does not apply to aggressive gradient-based attacks recently proposed by [12,34,35,31] and model inversion attacks in [11,18]. These attacks follow the Bayesian restoration framework introduced in the present paper.…”

Section: Related Workmentioning

confidence: 93%

Federated Deep Learning with Bayesian Privacy

Gu,

Fan,

et al. 2021

Preprint

View full text Add to dashboard Cite

Federated learning (FL) aims to protect data privacy by cooperatively learning a model without sharing private data among users. For Federated Learning of Deep Neural Network with billions of model parameters, existing privacy-preserving solutions are unsatisfactory. Homomorphic encryption (HE) based methods provide secure privacy protections but suffer from extremely high computational and communication overheads rendering it almost useless in practice [14,16,32]. Deep learning with Differential Privacy (DP) [5] was implemented as a practical learning algorithm at a manageable cost in complexity [1]. However, DP is vulnerable to aggressive Bayesian restoration attacks as disclosed in the literature [12,34,35,31] and demonstrated in experimental results of this work. To address the aforementioned perplexity, we propose a novel Bayesian Privacy (BP) framework which enables Bayesian restoration attacks to be formulated as the probability of reconstructing private data from observed public information. Specifically, the proposed BP framework accurately quantifies privacy loss by Kullback-Leibler (KL) Divergence between the prior distribution about the privacy data and the posterior distribution of restoration private data conditioning on exposed information. To our best knowledge, this Bayesian Privacy analysis is the first to provides theoretical justification of secure privacy-preserving capabilities against Bayesian restoration attacks. As a concrete use case, we demonstrate that a novel federated deep learning method using private passport layers is able to simultaneously achieve high model performance, privacy-preserving capability and low computational complexity. Theoretical analysis is in accordance with empirical measurements of information leakage extensively experimented with a variety of DNN networks on image classification MNIST, CIFAR10, and CIFAR100 datasets.

show abstract

Section: Related Workmentioning

confidence: 93%

Federated Deep Learning with Bayesian Privacy

Gu,

Fan,

et al. 2021

Preprint

View full text Add to dashboard Cite

show abstract

“…As for the methodology, we will use the framework of statistical hypothesis testing in a similar vein to [7] where the authors determine an appropriate value of the privacy parameter as a function of false alarm and mis-detection probabilities in deciding on the presence or absence of a particular record in a dataset. Similarly, in [8], the author studies the differentially private hypothesis testing in the local setting where users locally add the DP noise on their personal data before submitting it to the dataset.…”

Section: Related Work and Methodologymentioning

confidence: 99%

“…• We derive a trade-off between the privacy protected adversary's advantage and the security of the system for the adversary to remain undetected while giving as much damage as possible to the system or, alternatively, for the defender to preserve the privacy of the system and detect the attacker. This trade-off is defined in the framework of statistical hypothesis testing similarly to [7].…”

Section: Contributionsmentioning

confidence: 99%

“…Theorem 1. The threshold of the best critical region of size α defined in (7) for deciding between the null hypothesis and its alternative of the one-sided hypothesis testing problem in (5) for a Laplace mechanism with the largest power β is given as a function of the probability of false alarm α, privacy parameter ǫ and global sensitivity s as follows…”

Section: One-sided Testmentioning

confidence: 99%

See 1 more Smart Citation

A Statistical Threshold for Adversarial Classification in Laplace Mechanisms

Unsal¹,

Önen²

2021

Preprint

View full text Add to dashboard Cite

This paper studies the statistical characterization of detecting an adversary who wants to harm some computation such as machine learning models or aggregation by altering the output of a differentially private mechanism in addition to discovering some information about the underlying dataset. An adversary who is able to modify the published information from a differentially private mechanism aims to maximize the possible damage to the system while remaining undetected. We present a trade-off between the privacy parameter of the system, the sensitivity and the attacker's advantage (the bias) through determining the threshold for the best critical region of the hypothesis testing problem for deciding whether or not the adversary's attack is detected. Such trade-offs are provided for Laplace mechanisms using one-sided and two-sided hypothesis tests. Corresponding error probabilities are analytically derived and ROC curves are presented for various levels of the sensitivity, the absolute mean of the attack and the privacy parameter. Subsequently, we provide an interval for the bias induced by the adversary so that the defender detects the attack. Finally, we adapt the Kullback-Leibler differential privacy to adversarial classification.

show abstract

“…Liu et al [ 54 ] showed how ε influences the accuracy of differentially private hypothesis testing. They proposed a method to determine an appropriate value for ε that can be useful for determining the ε value for our proposed algorithm; however, determining ε is outside the scope of our paper.…”

Section: Related Workmentioning

confidence: 99%

Privacy-preserving chi-squared test of independence for small samples

Sei

Ohsuga

2021

BioData Mining

View full text Add to dashboard Cite

Background The importance of privacy protection in analyses of personal data, such as genome-wide association studies (GWAS), has grown in recent years. GWAS focuses on identifying single-nucleotide polymorphisms (SNPs) associated with certain diseases such as cancer and diabetes, and the chi-squared (χ2) hypothesis test of independence can be utilized for this identification. However, recent studies have shown that publishing the results of χ2 tests of SNPs or personal data could lead to privacy violations. Several studies have proposed anonymization methods for χ2 testing with ε-differential privacy, which is the cryptographic community’s de facto privacy metric. However, existing methods can only be applied to 2×2 or 2×3 contingency tables, otherwise their accuracy is low for small numbers of samples. It is difficult to collect numerous high-sensitive samples in many cases such as COVID-19 analysis in its early propagation stage. Results We propose a novel anonymization method (RandChiDist), which anonymizes χ2 testing for small samples. We prove that RandChiDist satisfies differential privacy. We also experimentally evaluate its analysis using synthetic datasets and real two genomic datasets. RandChiDist achieved the least number of Type II errors among existing and baseline methods that can control the ratio of Type I errors. Conclusions We propose a new differentially private method, named RandChiDist, for anonymizing χ2 values for an I×J contingency table with a small number of samples. The experimental results show that RandChiDist outperforms existing methods for small numbers of samples.

show abstract

Investigating Statistical Privacy Frameworks from the Perspective of Hypothesis Testing

Cited by 26 publications

References 52 publications

Federated Deep Learning with Bayesian Privacy

Federated Deep Learning with Bayesian Privacy

A Statistical Threshold for Adversarial Classification in Laplace Mechanisms

Privacy-preserving chi-squared test of independence for small samples

Contact Info

Product

Resources

About