Privacy Adversarial Network

Abstract

The remarkable success of machine learning has fostered a growing number of cloud-based intelligent services for mobile users. Such a service requires a user to send data, e.g. image, voice and video, to the provider, which presents a serious challenge to user privacy. To address this, prior works either obfuscate the data, e.g. add noise and remove identity information, or send representations extracted from the data, e.g. anonymized features. They struggle to balance between the service utility and data privacy because obfuscated data reduces utility and extracted representation may still reveal sensitive information.This work departs from prior works in methodology: we leverage adversarial learning to better balance between privacy and utility. We design a representation encoder that generates the feature representations to optimize against the privacy disclosure risk of sensitive information (a measure of privacy) by the privacy adversaries, and concurrently optimize with the task inference accuracy (a measure of utility) by the utility discriminator. The result is the privacy adversarial network (PAN), a novel deep model with the new training algorithm, that can automatically learn representations from the raw data. And the trained encoder can be deployed on the user side to generate representations that satisfy the task-defined utility requirements and the user-specified/agnostic privacy budgets.Intuitively, PAN adversarially forces the extracted representations to only convey information required by the target task. Surprisingly, this constitutes an implicit regularization that actually improves task accuracy. As a result, PAN achieves better utility and better privacy at the same time! We report extensive experiments on six popular datasets, and demonstrate the superiority of PAN compared with alternative methods reported in prior work. CCS Concepts: • Human-centered computing → Ubiquitous and mobile computing systems and tools; • Security and privacy → Usability in security and privacy. 144:2 • Liu et al.activity records, to the service provider, posing well-known privacy risks [1,2,9]. Our goal is to avoid disclosing raw data to service providers by creating a device-local intermediate component that encodes the raw data and only sends the encoded data to the service provider. And the encoded data must be both useful and private. For inference-based services, utility can be quantified by the inference accuracy, achieved by the service provider using a discriminative model. And Privacy can be quantified by the disclosure risk of private information.Existing solutions addressing the privacy concern struggle to balance between above two seemingly conflicting objectives: privacy vs. utility. An obvious and widely practiced solution is to transform the raw data into taskspecific features and upload features only, like Google Now [17] and Google Cloud [16]; This not only reduces the data utility but also is vulnerable to reverse models that reconstruct the raw data from extracted features [28]. The authors of...

Towards a new era of mass data collection: Assessing pandemic surveillance technologies to preserve user privacy

“…(2015) IEEE Transactions on Computers Computer Science ● ○ Libaque-Sáenz et al. (2020) Information & Management Information Systems & Management ● ○ Liu et al. (2019) Procc.…”

User Consented Federated Recommender System Against Personalized Attribute Inference Attack

“…We also validate our method's effectiveness in privacy preservation. To the best of our knowledge, there are no techniques that can provide personalized and compositional privacy protection in federated learning, therefore, we only select 2 types of data privacy-preserving baselines [29] and compare our framework's overall protection performance on all attributes with them for a fair comparison. A detailed introduction of these baselines is listed below: Noise perturbation: We train the base FedRec and apply Gaussian noise N (0, 𝜎 2 ) to trained private user embeddings in the server.…”

Task-Agnostic Privacy-Preserving Representation Learning for Federated Learning against Attribute Inference Attacks

“…Privacy-preserving FL against inference attacks. Secure multi-party computation (Danner and Jelasity 2015;Mohassel and Zhang 2017;Bonawitz et al 2017;Melis et al 2019), adversarial training (Oh, Fritz, and Schiele 2017;Wu et al 2018;Madras et al 2018;Pittaluga, Koppal, and Chakrabarti 2019;Liu et al 2019;Kim et al 2019), model compression (Zhu, Liu, and Han 2019), and differential privacy (DP) (Pathak, Rane, and Raj 2010;Shokri and Shmatikov 2015;Hamm, Cao, and Belkin 2016;McMahan et al 2018;Geyer, Klein, and Nabi 2017;Wei et al 2020) are the four typical privacy-preserving FL methods. For example, Bonawitz et al (2017) design a secure multi-party aggregation for FL, where devices are required to encrypt their local models before uploading them to the server.…”

“…To mitigate the issue, various existing privacy-preserving FL methods can be adopted/adapted, including multi-party computation (MPC) (Danner and Jelasity 2015;Mohassel and Zhang 2017;Bonawitz et al 2017;Melis et al 2019), adversarial training (AT) (Madras et al 2018;Liu et al 2019;Li et al 2020a;Oh, Fritz, and Schiele 2017;Kim et al 2019), model compression (MC) (Zhu, Liu, and Han 2019), and differential privacy (DP) (Pathak, Rane, and Raj 2010;Shokri and Shmatikov 2015;Hamm, Cao, and Belkin 2016;McMahan et al 2018;Geyer, Klein, and Nabi 2017). However, these existing methods have key limitations, thus narrowing their applicability (see Table 1).…”