Minimax Filter: Learning to Preserve Privacy from Inference Attacks

By Jihun Hamm. 2016

84 citations recorded by the source corpus.

Preserving privacy of continuous and/or high-dimensional data such as images, videos and audios, can be challenging with syntactic anonymization methods which are designed for discrete attributes. Differential privacy, which provides a more formal definition of privacy, has shown more success in sanitizing continuous data. However, both syntactic and differential privacy are susceptible to inference attacks, i.e., an adversary can accurately infer sensitive attributes from sanitized data. The paper proposes a novel filter-based mechanism which preserves privacy of continuous and high-dimensional attributes against inference attacks. Finding the optimal utility-privacy tradeoff is formulated as a min-diff-max optimization problem. The paper provides an ERM-like analysis of the generalization error and also a practical algorithm to perform the optimization. In addition, the paper proposes an extension that combines minimax filter and differentially-private noisy mechanism. Advantages of the method over purely noisy mechanisms is explained and demonstrated with examples. Experiments with several real-world tasks including facial expression classification, speech emotion classification, and activity classification from motion, show that the minimax filter can simultaneously achieve similar or better target task accuracy and lower inference accuracy, often significantly lower than previous methods.

Subfields: Artificial Intelligence

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

Citations in the corpus

DISCO: Dynamic and Invariant Sensitive Channel Obfuscation for deep neural networks (2020, methodology): “As noted before, we adapt to the setup described by Hamm [55].”
Contamination Attacks and Mitigation in Multi-Party Machine Learning (2018, result): “Adversarial learning has been considered as a defense for several privacy tasks, including learning of a privacy-preserving data filter in a multi-party setting [15], learning a privacy-preserving record representation [10], while, in parallel to our work, Nasr et al.”
Comprehensive Privacy Analysis of Deep Learning: Passive and Active White-box Inference Attacks against Centralized and Federated Learning (2018, background): “Several works [28], [29], [30] have shown that by using adversarial training, one can find a better trade-off between privacy and model accuracy.”
A Study of Face Obfuscation in ImageNet (2021, background): “For example, model inversion attack recovers sensitive attributes (e.g., gender) of an individual given the model’s output (Fredrikson et al., 2014; 2015; Hamm, 2017; Li et al., 2019; Wu et al., 2019).”
Learning Generative Adversarial RePresentations (GAP) under Fairness and Censoring Constraints (2019, background): “The author in (Hamm, 2016) considers a deterministic, compressive mapping of the input data with differentially private noise added either before or after the mapping.”
Context-Aware Generative Adversarial Privacy (2017, background): “DP-based obfuscators for data publishing have been considered in [35, 54].”
Mobile sensor data anonymization (2018, background): “regulates the transformed data to give as little information as possible about the user’s identity; subject to minimum possible distortion in the data to preserve the utility. Unlike other approaches [12, 13, 28, 32] the training process not only regulates the encoder to only consider task-specific ”
Generative Adversarial Privacy: A Data-Driven Approach to Information-Theoretic Privacy (2018, background): “DP-based obfuscators for data publishing have been considered in [13, 21].”
Towards Privacy-Preserving Visual Recognition via Adversarial Training: A Pilot Study (2018, background): “In other words, an adversary can still accurately infer sensitive attributes from any sanitized sample available, which does not violate any of the (proven) properties of differential privacy [18].”
A Survey on Differential Privacy for Unstructured Data Content (2022, methodology): “Inference attack [43, 87] is another effective attack that may pose significant privacy risks to DP-protected data.”
Olympus: Sensor Privacy through Utility Aware Obfuscation (2018, unknown): “Most of the previous approaches of data obfuscation do not consider the target apps in designing the mechanism [18, 21, 41].”
Overlearning Reveals Sensitive Attributes (2019, methodology): “Techniques include adversarial training (Edwards & Storkey, 2016), which has been applied to census and health records (Xie et al., 2017), text (Li et al., 2018; Coavoux et al., 2018; Elazar & Goldberg, 2018), images (Hamm, 2017) and sensor data of wearables (Iwasawa et al., 2016).”