Not All Features Are Equal: Discovering Essential Features for Preserving Prediction Privacy

Mireshghallah, Fatemehsadat; Taram, Mohammadkazem; Jalali, Ali; Elthakeb, Ahmed T.; Tullsen, Dean M.; Esmaeilzadeh, Hadi

doi:10.48550/arxiv.2003.12154

Cited by 1 publication

(2 citation statements)

References 0 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…A similar insight has been used by recent work Cloak [12] to improve inference privacy, which uses a fixed noise distribution to perturb the input and hide the nonconducive features. However, the set of conducive and non-conducive features are not fixed and can change significantly across various inputs.…”

Section: Introductionmentioning

confidence: 91%

See 1 more Smart Citation

Enabling Inference Privacy with Adaptive Noise Injection

Kariyappa,

Dia,

Qureshi

2021

Preprint

View full text Add to dashboard Cite

User-facing software services are becoming increasingly reliant on remote servers to host Deep Neural Network (DNN) models, which perform inference tasks for the clients. Such services require the client to send input data to the service provider, who processes it using a DNN and returns the output predictions to the client. Due to the rich nature of the inputs such as images and speech, the input often contains more information than what is necessary to perform the primary inference task. Consequently, in addition to the primary inference task, a malicious service provider could infer secondary (sensitive) attributes from the input, compromising the client's privacy. The goal of our work is to improve inference privacy by injecting noise to the input to hide the irrelevant features that are not conducive to the primary classification task. To this end, we propose Adaptive Noise Injection (ANI), which uses a light-weight DNN on the client-side to inject noise to each input, before transmitting it to the service provider to perform inference. Our key insight is that by customizing the noise to each input, we can achieve state-of-the-art trade-off between utility and privacy (up to 48.5% degradation in sensitive-task accuracy with < 1% degradation in primary accuracy), significantly outperforming existing noise injection schemes. Our method does not require prior knowledge of the sensitive attributes and incurs minimal computational overheads.

show abstract

Section: Introductionmentioning

confidence: 91%

“…2. Cloak: Similar to our proposal, a recent work Cloak [12] proposes to preprocess the input by injecting noise with the goal of hiding non-conducive features as shown in the equations below:…”

Section: Algorithmic Solutionsmentioning

confidence: 99%