DISCO: Dynamic and Invariant Sensitive Channel Obfuscation for deep neural networks

Abstract

Recent deep learning models have shown remarkable performance in image classification. While these deep learning systems are getting closer to practical deployment, the common assumption made about data is that it does not carry any sensitive information. This assumption may not hold for many practical cases, especially in the domain where an individual's personal information is involved, like healthcare and facial recognition systems. We posit that selectively removing features in this latent space can protect the sensitive information and provide better privacy-utility trade-off. Consequently, we propose DISCO which learns a dynamic and data driven pruning filter to selectively obfuscate sensitive information in the feature space. We propose diverse attack schemes for sensitive inputs & attributes and demonstrate the effectiveness of DISCO against state-ofthe-art methods through quantitative and qualitative evaluation. Finally, we also release an evaluation benchmark dataset of 1 million sensitive representations to encourage rigorous exploration of novel attack schemes.

Learning to Censor by Noisy Sampling

“…-Oriented Sampling -Agnostic Noise (OS-AN): Uses differentiable point cloud sampling (as in CBNS) with fixed gaussian distribution for noise. This is inspired from [28] which does channel pruning of image activations to remove sensitive information. While [28] trains a DNN to prune neural activations, we train a DNN to sample point clouds [31].…”

“…This is inspired from [28] which does channel pruning of image activations to remove sensitive information. While [28] trains a DNN to prune neural activations, we train a DNN to sample point clouds [31].…”

“…However, for training the model parameters, we use a proxy adversary from which gradients can be propagated. We refer to the attack performed by this proxy attacker as an online attack and note that this allows mimicking worstcase setups where the attacker can also dynamically adapt using protected data and sensitive label information [28]. We note that our definition of privacy sig-nificantly differs from differential privacy [26] since we aim to protect sensitive attributes instead of the identity of the data owner.…”

“…In other words, censoring a point cloud using CBNS also generates a point cloud. In contrast: i) most work for censoring images requires releasing neural activations which cannot be processed by arbitrary designed networks [28,33,32] and ii) prior work for censoring point clouds releases line clouds [21,20] which, while useful for geometric tasks, are incompatible for off-the-shelf perception networks.…”

AdaSplit: Adaptive Trade-offs for Resource-constrained Distributed Deep Learning

“…In addition to the computational and communication benefit, split learning allows distributed and privacy-preserving prediction that is not possible under the federated learning framework. Consequently, several works have used split learning for inference to build defense [7,45,50,57,61,69,70,74,84,87] and attack mechanisms [32,53,64]. Some of these benefits have led to applied evaluation of split learning for mobile phones [62], IoT [37,38,63], model selection [71,72] and healthcare [65].…”