Deep Private-Feature Extraction

By Seyed Ali Ossia, Ali Taheri, Ali Shahin Shamsabadi, Kleomenis Katevas, Hamed Haddadi, Hamid Reza Rabiee. 2018

107 citations recorded by the source corpus.

We present and evaluate Deep Private-Feature Extractor (DPFE), a deep model which is trained and evaluated based on information theoretic constraints. Using the selective exchange of information between a user's device and a service provider, DPFE enables the user to prevent certain sensitive information from being shared with a service provider, while allowing them to extract approved information using their model. We introduce and utilize the log-rank privacy, a novel measure to assess the effectiveness of DPFE in removing sensitive information and compare different models based on their accuracy-privacy trade-off. We then implement and evaluate the performance of DPFE on smartphones to understand its complexity, resource demands, and efficiency trade-offs. Our results on benchmark image datasets demonstrate that under moderate resource utilization, DPFE can achieve high accuracy for primary tasks while preserving the privacy of sensitive information.

Subfields: Artificial Intelligence, Computer Science Applications, Sociology and Political Science

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Computer Science Applications

In Sociology and Political Science

Citations in the corpus

Privacy in Deep Learning: A Survey (2020, methodology): “However, in the task of inferring private labels, DPFE performs slightly better by causing a higher misclassification rate for the adversary since it has access to the private labels during training time.”
Exploiting Unintended Feature Leakage in Collaborative Learning (2018, background): “For instance, techniques that learn only the features relevant to a given task [15, 42, 43] can potentially serve as the basis for “leastprivilege” collaboratively trained models.”
Information Leakage in Embedding Models (2020, background): “or fairness concern [9, 18, 38]. Another approach for removing sensitive attributes is through directly minimizing the mutual information between the sensitive attributes and the deep representations [47, 50]. We adopt the adversarial training approach during training embedding models as defense aga”
Overlearning Reveals Sensitive Attributes (2019, background): “The requirement that z not reveal s can be formalized as an independence constraint z ⊥ s, but independence is intractable to measure in practice, thus the requirement is relaxed to a constraint on the mutual information between z and s [28, 30].”
Privacy and Utility Preserving Sensor-Data Transformations (2019, background): “Transformations can reduce the amount of sensitive information in the data by reconstruction [12] or by projecting each data sample into a lower dimensional latent representation [13, 28].”
A Principled Approach to Learning Stochastic Representations for Privacy in Deep Neural Inference (2020, methodology): “use of their private information. methods, unlike Cloak, either use homomorphic encryption that suffers from prohibitive computational costs (Dowlin et al.,2016), need labels for private information (Osia et al., 2020), or require signiﬁcant changes/retraining in model architecture/weights (Wang et ”
PrivEdge: From Local to Distributed Private Training and Prediction (2020, background): “A feature extractor can be obtained by solving an optimisation problem that maximises the mutual information between the feature set and non-sensitive variables, while minimising mutual information between the feature set and private variables [15], [48], [49].”
Adversarial representation learning for synthetic replacement of private attributes (2020, unknown): “Osia et al. (2020) approached the problem using an information-bottleneck.”
Mobile sensor data anonymization (2018, methodology): “stribution of data or to model, using variational autoencoders (VAE) [14], data with well-known distributions. These techniques can be applied to quantify mutual information for optimization problems [7, 11, 24, 34] and can be used to remove sensitive information from latent low-dimensional represen”
Inference Attacks Against Collaborative Learning (2018, background): “nt sharing, reducing dimensionality, and dropout are not effective. This should motivate future work on better defenses. For instance, techniques that learn only the features relevant to a given task [15,42,43] can potentially serve as the basis for “leastprivilege” collaboratively trained models. F”
The Deep Learning Compiler: A Comprehensive Survey (2020, unknown): “To protect privacy in edge-cloud system, existing approaches [73], [74], [75] propose to add noise with special statistic properties to the intermediate results that can reduce the accuracy of the attacker task without severely”
A Hybrid Deep Learning Architecture for Privacy-Preserving Mobile Analytics (2017, methodology): “encryption-based methods, an information-theoretic approach is recently introduced in [49], where the main focus is on discarding information related to a single user-defined sensi-”
Shredder: Learning Noise to Protect Privacy with Partial DNN Inference on the Edge (2019, methodology): “Non-Intrusive Intrusive + Inference Shredder MiniONN[21] CryptoNets[19], GAZELLE[48], Arden[49], DPFE[50, 51]”
Shredder: Learning Noise Distributions to Protect Inference Privacy (2019, methodology): “wn from a Laplace distribution. More recently, Wang et al. [49] proposes data nulliﬁcation and noise injection for private inference. 7 However, unlike Shredder, they retrain the network. Osia et al. [51, 50] design a private feature extraction architecture that uses principal component analysis (PC”