Privacy-preserving Machine Learning through Data Obfuscation

By Tianwei Zhang, Zecheng He, Ruby B. Lee. 2018

90 citations recorded by the source corpus.

As machine learning becomes a practice and commodity, numerous cloud-based services and frameworks are provided to help customers develop and deploy machine learning applications. While it is prevalent to outsource model training and serving tasks in the cloud, it is important to protect the privacy of sensitive samples in the training dataset and prevent information leakage to untrusted third parties. Past work have shown that a malicious machine learning service provider or end user can easily extract critical information about the training samples, from the model parameters or even just model outputs. In this paper, we propose a novel and generic methodology to preserve the privacy of training data in machine learning applications. Specifically we introduce an obfuscate function and apply it to the training data before feeding them to the model training task. This function adds random noise to existing samples, or augments the dataset with new samples. By doing so sensitive information about the properties of individual samples, or statistical properties of a group of samples, is hidden. Meanwhile the model trained from the obfuscated dataset can still achieve high accuracy. With this approach, the customers can safely disclose the data or models to third-party providers or end users without the need to worry about data privacy. Our experiments show that this approach can effective defeat four existing types of machine learning privacy attacks at negligible accuracy cost.

Subfields: Artificial Intelligence, Computer Vision and Pattern Recognition

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Computer Vision and Pattern Recognition

Citations in the corpus

Privacy in Deep Learning: A Survey (2020, background): “d trying to remove sensitiveinformationfromitwhilemaintainingthestatistical trends [21, 22]. The second class focuses on making the DNN training phase private and protecting the data used for training[23,24,25,26,27,28]. Thelastclass,ofwhichthere is only a handful of works, attempts to protect the p”
The Value of Collaboration in Convex Machine Learning with Differential Privacy (2019, background): “Generalizations for obfuscating individual and group-level trends by DP additive noise are presented in [28].”
Membership Inference Attacks on Machine Learning: A Survey (2021, background): “• Attack F1-score [162] ([65, 76, 134, 164, 215, 237, 239]) Attack F1-score is the harmonic mean of Attack Precision and Attack Recall:”
Model inversion attacks against collaborative inference (2019, background): “[51] showed that adding noise to the training dataset is effective in protecting training data privacy.”
Adversarially Learned Representations for Information Obfuscation and Inference (2019, background): “, 2017), protecting training data in machine learning (Shokri & Shmatikov, 2015; Zhang, 2018), fairness (Madras et al.”
When Machine Learning Meets Privacy (2020, methodology): “[132] ✓ ✓ Obfuscation DP SVM Centralised [18] ✓ ✓ Obfuscation DP ERM Centralised [146] ✓ ✓ Obfuscation DP-SGD for convex objectives Centralised [140] ✓ ✓ Obfuscation DPSGD Distributed [2] ✓ ✓ Obfuscation DPSGD Centralised [100] ✓ ✓ Obfuscation multi-round DP Centralised [95] ✓ ✓ Obfuscation DP-FedAv”
Deep Learning With Edge Computing: A Review (2019, background): “Zhang [135] considered different types of noise that can be added to the input data before training.”